CVSS 9.13 sources verified·1 min read
By Lyrie Threat Intelligence·5/5/2026
CRITICAL: CVE-2026-43534 (CVSS 9.1) — multiple products
CVE: CVE-2026-43534
CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL
Status: Critical advisory
Affected
_See vendor advisory_
Summary
OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.
Verified Sources
References
- https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29
- https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr
- https://www.vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events
_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._
Lyrie Verdict
A vulnerability of this severity is exactly what Lyrie's anti-rogue-AI defense is built for: continuous, autonomous monitoring that doesn't wait for human reaction time.
Validated sources
- [1]NVD
- [2]GitHub Advisory
- [3]MITRE