This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OpenClaw suffers from a **Privilege Escalation** flaw. The system fails to downgrade permissions correctly when handling specific events.โฆ
๐ก๏ธ **Root Cause**: **CWE-184** (Incomplete List of Disallowed Inputs). The **Heartbeat Owner Downgrade Logic** is flawed. It skips the security check when processing **Webhook Wake Events** carrying untrusted content. ๐ซ
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: **OpenClaw** product. ๐ **Versions**: All versions **before 2026.4.14**, specifically those prior to **2026.4.7**. โ **Fixed**: Version **2026.4.14** and later.
Q4What can hackers do? (Privileges/Data)
๐ป **Attackers Can**: Escalate privileges from standard user to **Owner/Root**. ๐๏ธ **Impact**: Gain **High** Confidentiality & Integrity impact.โฆ
โก **Threshold**: **LOW**. ๐ **Vector**: Network (AV:N). ๐ **Auth**: None required (PR:N). ๐๏ธ **UI**: None required (UI:N). ๐ฏ **Complexity**: Low (AC:L). This is a **Remote, Unauthenticated** exploit! ๐ฑ
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ต๏ธ **Public Exp?**: **No**. The `pocs` field is empty. ๐ **Advisories**: GitHub (GHSA-g2hm-779g-vm32) and VulnCheck have published details, but no functional PoC code is publicly available yet. ๐ซ
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for **OpenClaw** instances. ๐ **Verify Version**: Ensure you are running **2026.4.14** or newer.โฆ
๐ง **Official Fix**: **YES**. ๐ **Patch**: Commit `31281bc92f55796817a92bc43f722cba1e77ab42`. ๐ **Action**: Upgrade OpenClaw to version **2026.4.14** immediately to close the privilege escalation gap. โ
Q9What if no patch? (Workaround)
๐ง **No Patch?**: If you cannot upgrade, strictly **validate inputs** for Webhook Wake Events. ๐ก๏ธ **Mitigation**: Implement strict allow-lists for webhook sources.โฆ
๐ฅ **Urgency**: **CRITICAL**. ๐จ **Priority**: **P1**. With **CVSS 9.0+** (High C/I, N A) and **No Auth** required, this is a high-risk, easy-to-exploit vulnerability.โฆ