CVE-2026-43534CWE-345

OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events

Critical · published May 5, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events
    cvelistv5