OpenClaw Input Validation Flaw (CVE-2026-43534) Rated Critical

The National Vulnerability Database has issued an advisory for CVE-2026-43534, a critical input validation vulnerability in OpenClaw versions prior to 2026.4.10. This flaw carries a CVSS score of 9.1, indicating severe risk.

According to the National Vulnerability Database, this vulnerability allows attackers to bypass trust boundaries by enqueuing external hook metadata as trusted system events. By supplying malicious hook names, untrusted input can be escalated into a higher-trust agent context, potentially leading to unauthorized operations and system compromise. The vulnerability is categorized under CWE-345 (Insufficient Verification of Data Authenticity).

While specific affected products beyond ‘OpenClaw’ are not detailed, organizations utilizing OpenClaw should prioritize immediate review and patching. This type of vulnerability is a goldmine for attackers, as it offers a direct path to elevate privileges and execute arbitrary code within a trusted system environment without requiring complex exploit chains. It’s a classic case of failing to validate input at the security boundary, and it opens the door wide for an attacker who understands the agent’s internal logic.