9.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43566

CVE-2026-43566: OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43566

CVE-2026-43566:

9.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.4.7, < 2026.4.14	2026.4.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw (CVE-2026-43566) allowed for an incorrect authorization scenario where untrusted webhook events could be processed with owner-level privileges. This was due to a flaw in the heartbeat owner downgrade logic, which missed checking for untrusted hook:wake system events.

The analysis of the patch commit 31281bc92f55796817a92bc43f722cba1e77ab42 reveals two key functions that were modified to address this vulnerability:

runHeartbeatOnce in src/infra/heartbeat-runner.ts: This function is the entry point for handling heartbeat events. The patch modifies it to explicitly check if any pending system events are marked as untrusted (event.trusted === false). If untrusted events are found, it sets a ForceSenderIsOwnerFalse flag. This is the primary mitigation at the event-handling layer.
runPreparedReply in src/auto-reply/reply/get-reply-run.ts: This function is responsible for constructing and running the final reply. It was modified to act on the information from the event handler. It now checks for untrusted content within the system event blocks using a regular expression (/^System \(untrusted\\):/m) and also respects the ForceSenderIsOwnerFalse flag passed down from runHeartbeatOnce. This ensures that the senderIsOwner property is correctly set to false before the reply is executed, effectively downgrading the privileges.

During an exploit, a specially crafted webhook would trigger a hook:wake event. The runHeartbeatOnce function would be called to process this event. In a vulnerable version, this function would fail to detect the untrusted nature of the event, allowing runPreparedReply to execute with senderIsOwner set to true. Both of these functions would therefore appear in a runtime profile or stack trace during exploitation.

Vulnerable functions

runPreparedReply

src/auto-reply/reply/get-reply-run.ts

This function is responsible for preparing and executing a reply. The vulnerability lies in the fact that it previously did not correctly downgrade the `senderIsOwner` status when processing system events from untrusted sources, such as webhooks. The patch introduces a check (`forceSenderIsOwnerFalseFromSystemEvents`) that is set to true if an untrusted system event is detected. This flag is then used to force `senderIsOwner` to `false`, preventing the execution from running with elevated privileges. The original code directly assigned `command.senderIsOwner`, missing the necessary security check for untrusted event types.

runHeartbeatOnce

src/infra/heartbeat-runner.ts

This function orchestrates the execution of heartbeat tasks. It was vulnerable because it failed to account for untrusted `hook:wake` system events when determining if a process should run with owner privileges. The patch introduces logic to inspect pending events for an untrusted status (`hasUntrustedPendingEvents`). This information is then used to set `ForceSenderIsOwnerFalse` to `true`, ensuring that the subsequent reply generation logic downgrades the execution context. Before the fix, this check was missing for certain wake events, allowing untrusted content to be processed with owner-like permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.