PT-2026-38233 · Openclaw · Openclaw
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions 2026.3.31 through 2026.4.9
Description
A privilege escalation issue exists where heartbeat owner downgrade detection fails to identify local background async exec completion events. This allows attackers to provide untrusted completion content to execute a run in a more privileged context than intended.
Recommendations
Update to version 2026.4.10.
Exploit
Fix
LPE
Improper Privilege Management
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw