CVE-2026-43566: Privilege Escalation in OpenClaw Webhook Wakes

CVE-2026-43566 is a privilege escalation flaw (CVSS 9.1) in OpenClaw versions from 2026.4.7 up to but not including 2026.4.14. The heartbeat downgrade logic skips webhook wake events with untrusted content, so a run keeps owner-like rights it should lose. Upgrade to 2026.4.14 or later.

What's affected

The record gives a narrow range: versions from 2026.4.7 before 2026.4.14. If you run a release older than 2026.4.7 the record does not list you as affected, and 2026.4.14 is the fixed version.

The project advisory is GHSA-g2hm-779g-vm32, which I did not retrieve.

How to check if you're exposed

Find the version of OpenClaw you run and compare it with the fixed version above. If you installed it with npm, this works:

npm ls -g openclaw

Otherwise use the version your installer, container tag or deployment record shows. Then list the gateways, channels and webhooks that are exposed to people or systems you do not control, since these issues concern how untrusted input is handled.

Note whether you accept webhook wake events from outside parties.

What to do now

1. Upgrade OpenClaw to 2026.4.14 or later.
2. Authenticate and restrict webhook sources.
3. Review which actions an owner level run can take, and trim them.
4. Check run logs for owner level runs that began from webhook events you did not expect.
5. Record the version in your inventory.

Why it matters

The weakness is CWE-184, incomplete list of disallowed inputs. A check meant to lower the privileges of a run when untrusted content is involved skipped one kind of event, so a run triggered that way stayed at the higher level.

Downgrade rules only work if every entry path goes through them. A missed path defeats the whole control. The KEV flag is false.

Quick check

Sources

• GitHub security advisory GHSA-g2hm-779g-vm32 (listed in the NVD record, not retrieved)
• VulnCheck advisory (listed in the NVD record, not retrieved)
• Gold page for this CVE

Last reviewed: 19 October 2026.