CVE-2026-43578: OpenClaw Privilege Escalation Vulnerability

CVE-2026-43578 Overview

CVE-2026-43578 is a privilege escalation vulnerability in OpenClaw versions 2026.3.31 before 2026.4.10. The flaw resides in the heartbeat owner downgrade detection logic, which fails to account for local background asynchronous execution completion events. Attackers can supply untrusted completion content that causes a run to remain in a more privileged context than intended. The weakness is classified as an Incomplete List of Disallowed Inputs [CWE-184], allowing remote attackers to bypass intended privilege boundaries without authentication.

Critical Impact

Remote attackers without authentication can elevate privileges by injecting crafted async exec completion content, retaining execution in a privileged owner context.

Affected Products

• OpenClaw 2026.3.31
• OpenClaw versions after 2026.3.31 and before 2026.4.10
• Fixed in OpenClaw 2026.4.10

Discovery Timeline

• 2026-05-06 - CVE-2026-43578 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43578

Vulnerability Analysis

The vulnerability stems from incomplete event coverage in OpenClaw's heartbeat owner downgrade detection mechanism. Heartbeat owner downgrade is the safeguard that returns a run to a lower-privilege context once privileged work completes. The detection logic enumerates a fixed set of completion events but omits local background async exec completions. Attackers exploit this gap by crafting completion content that the detector does not recognize as a downgrade trigger. As a result, the run retains its elevated owner identity beyond its intended lifetime.

The issue maps to CWE-184: Incomplete List of Disallowed Inputs. The detector enforces policy through enumeration rather than default-deny, so any completion path absent from the list silently bypasses the downgrade.

Root Cause

The root cause is a missing case in the downgrade detector. Local background async execution paths complete through a code branch that the heartbeat owner downgrade routine does not inspect. The fix in commit 19a2e9d extends detection to cover these events.

Attack Vector

The attack vector is network-based with no privileges or user interaction required. An attacker submits untrusted completion content to a target OpenClaw instance through an exposed async exec interface. The crafted content triggers a local background async exec path that bypasses downgrade detection. Subsequent operations in the same run inherit the elevated owner context, producing confidentiality and integrity impact on resources accessible to that owner.

Detailed exploitation mechanics are documented in the VulnCheck Privilege Escalation Advisory and the GitHub Security Advisory GHSA-g375-h3v6-4873.

Detection Methods for CVE-2026-43578

Indicators of Compromise

• Runs that remain associated with a privileged owner identity after async exec completion events.
• Heartbeat records showing no downgrade transition following local background async exec activity.
• Async exec completion payloads with unexpected or malformed content fields submitted from external sources.

Detection Strategies

• Audit OpenClaw run logs for owner identity continuity across async exec completion boundaries.
• Compare expected versus observed downgrade events per run lifecycle and alert on missing downgrades.
• Inspect inbound async exec completion content for fields not produced by trusted internal callers.

Monitoring Recommendations

• Forward OpenClaw heartbeat and run telemetry to a centralized log platform for retention and correlation.
• Build alerts on privileged actions performed after the expected downgrade window has elapsed.
• Track the deployed OpenClaw version across hosts and flag any instance running between 2026.3.31 and 2026.4.10.

How to Mitigate CVE-2026-43578

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.10 or later, which includes the fix from commit 19a2e9d.
• Restrict network exposure of OpenClaw async exec interfaces to trusted networks and authenticated callers only.
• Review recent run histories for evidence of runs that did not downgrade after async exec completion.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-g375-h3v6-4873 and applied in commit 19a2e9d. The patch extends heartbeat owner downgrade detection to recognize local background async exec completion events. Upgrade to OpenClaw 2026.4.10 to apply the fix.

Workarounds

• Block untrusted sources from submitting async exec completion content using network ACLs or a reverse proxy.
• Disable or constrain local background async exec functionality if it is not required by the deployment.
• Enforce stricter owner separation by running OpenClaw under least-privilege service accounts until the patch is applied.