CVE-2026-43566: OpenClaw Privilege Escalation via Untrusted Webhook Events

The National Vulnerability Database has identified CVE-2026-43566, a critical privilege escalation vulnerability (CVSS 9.1) affecting OpenClaw versions prior to 2026.4.14. The flaw stems from improper handling of webhook wake events, where the system fails to correctly downgrade execution context when processing untrusted content. This bypasses intended security checks, allowing an attacker to maintain elevated privileges.

Attackers can exploit this by sending specially crafted, untrusted webhook events. The vulnerability lies in the heartbeat owner downgrade logic, which incorrectly preserves an owner-like execution context instead of downgrading it as intended when processing these events. This allows for unauthorized privilege escalation, giving attackers broader access than they should have.

Defenders must prioritize patching OpenClaw installations to version 2026.4.14 or later immediately. Organizations should also audit their systems for any signs of exploitation, particularly focusing on webhook event logs and unusual privilege escalations around the time of event processing.