Executive brief
OpenClaw is a Node.js library for managing distributed execution and orchestration. A flaw in heartbeat processing causes local async execution completion events to be missed, allowing processes to retain elevated (owner) permissions when they should be downgraded to untrusted status after processing user-supplied output. This could enable privilege escalation if an attacker provides malicious completion text.
Technical details
The vulnerability is a privilege escalation (CWE-269) caused by incomplete detection of local async execution completion events in the heartbeat owner-downgrade mechanism. The `isExecCompletionEvent()` function only matched the remote-node event format ("exec finished") but missed local formats ("Exec completed" and "Exec failed"), causing `hasExecCompletion` to remain false for local exec runs. As a result, the `ForceSenderIsOwnerFalse` downgrade never triggered, leaving agents processing untrusted exec output with retained owner-level tool access. The fix extends the detection function to match both local completion formats and adds targeted unit tests. Versions 2026.3.31 through 2026.4.9 are affected; the patch is available in 2026.4.10 and later.
Affected products
- OpenClaw openclaw >=2026.3.31, <2026.4.10
Timeline
- 2026-04-17: disclosed
- 2026-04-10: patched: Fix released in v2026.4.10; npm package 2026.4.14 includes patch