CVE-2026-43578
Critical · 9.1CVSS
9.1
EPSS
0.5%
Published
May 6, 2026
CISA due date
—
The record
OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
- CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-184
- CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
- CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
- CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CWE-184
- CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validation… CWE-184
- CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon… CWE-184