CVE-2026-43574CWE-183

OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

Medium · published May 5, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-183 · Permissive List of Allowed Inputs
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists
    cvelistv5