CVE-2026-43534

Katalog CVE

CVSS 9.8 · Critical EPSS 0,30%

Kerentanan Insufficient Verification of Data Authenticity pada openclaw. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr advisory vendor
• https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29 patch
• https://www.vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events advisory pihak ketiga