PT-2026-37029

CVE-2026-43574

Published

2026-04-17

Updated

2026-05-05

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.12

Description An improper authorization issue exists in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. This logic flaw allows attackers to resolve pending approvals without proper authorization, provided they possess an approval id.

Recommendations Update to version 2026.4.12 or newer.

Exploitability

Exploit

Fix

Impacts

Researchers

Anshuman Bhartiya

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-183: Permissive List of Allowed Inputs