Executive brief
OpenClaw is an AI agent platform that processes system events and executes tasks. A trust-labeling defect allows output from scheduled cron jobs to be incorrectly marked as trusted system events. While this doesn't directly compromise authentication or sandboxing, an attacker could exploit this mislabeling to make malicious prompt-injection attacks appear more credible to the system, potentially manipulating the AI agent's behavior.
Technical details
OpenClaw contains a vulnerability in its cron awareness event handling where webhook-triggered isolated cron agent runs fail to preserve the untrusted:false label when queuing events into the main session awareness stream. This causes untrusted events to render as trusted "System:" events. The vulnerability is a trust-verification issue (CWE-345) that does not directly bypass gateway authentication, tool policies, or sandboxing—rather, it amplifies the impact of prompt-injection attacks by allowing attacker-controlled data to appear trusted. The fix, released in version 2026.4.20, preserves untrusted labels for isolated cron awareness events and forwards the trust flag through cron delivery helpers. This is tracked as CVE-2026-44999.
Affected products
- OpenClaw openclaw < 2026.4.20
Timeline
- 2026-04-25: disclosed: GHSA-57r2-h2wj-g887 published
- 2026-04-21: patched: OpenClaw 2026.4.20 released with fix (commit f61896b)