Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2026-43534 β€” AI Deep Analysis Summary

CVSS 9.1 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: OpenClaw fails to sanitize external hook metadata. πŸ“‰ **Consequences**: Untrusted input is treated as trusted system events.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: **CWE-345** (Insufficient Verification of Data Authenticity). The flaw lies in the input validation logic for **Agent Hook Events**.…

Q3Who is affected? (Versions/Components)

πŸ‘₯ **Affected**: **OpenClaw** versions **< 2026.4.10**. Any installation running these older versions is vulnerable. The specific component is the **Agent Hook Event** handler.

Q4What can hackers do? (Privileges/Data)

πŸ’€ **Attacker Capabilities**: Can elevate untrusted input to a **higher-trust agent context**. This allows for **High Confidentiality** and **High Integrity** impact.…

Q5Is exploitation threshold high? (Auth/Config)

⚑ **Exploitation Threshold**: **LOW**. CVSS indicates **AV:N** (Network), **AC:L** (Low Complexity), **PR:N** (No Privileges Required), **UI:N** (No User Interaction).…

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ” **Public Exploit**: **No**. The `pocs` array is empty. While references exist (GitHub Advisory, Patch Commit), there is no public Proof-of-Concept (PoC) or wild exploitation code available yet.

Q7How to self-check? (Features/Scanning)

πŸ”Ž **Self-Check**: Check your OpenClaw version. If it is **older than 2026.4.10**, you are vulnerable. Look for custom or external hook integrations that accept user-defined names or metadata.…

Q8Is it fixed officially? (Patch/Mitigation)

βœ… **Official Fix**: **Yes**. The vulnerability is fixed in version **2026.4.10** and later. A patch commit is available: `e3a845bde5b54f4f1e742d0a51ba9860f9619b29`. Update immediately.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If you cannot patch immediately, **disable external hook inputs** or restrict hook names to a strict allowlist. Ensure no user-controlled data is passed directly into the hook metadata queue.…

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: **HIGH**. With **CVSS High** severity and **No Auth Required**, this is a critical risk. Prioritize updating to **v2026.4.10+** immediately to prevent potential agent hijacking and data compromise.