Executive brief
OpenClaw is an automation and workflow orchestration tool that processes scheduled cron tasks and related events. A flaw in how it labels incoming webhook-triggered cron events causes them to be marked as trusted system events when they should be marked as untrusted, potentially allowing attackers to amplify prompt-injection attacks by disguising malicious inputs as legitimate system messages.
Technical details
The vulnerability is a trust-labeling issue (CWE-345) in OpenClaw's event handling for isolated cron awareness. Webhook-triggered cron agent output is queued into the main session awareness stream without the required `trusted: false` flag, causing untrusted events to render as trusted System events. The root cause is failure to preserve and forward the untrust label through cron delivery helpers. While the flaw strengthens prompt-injection attacks by making malicious inputs appear legitimate, it does not directly bypass authentication, tool policy, or sandboxing. The vulnerability affects all versions prior to 2026.4.20, which includes the fix in commit f61896b03cc7031f51106a04566831f4ac2a0bd7.
Affected products
- OpenClaw OpenClaw before 2026.4.20
Timeline
- 2026-04-21: disclosed
- 2026-04-20: patched: Fix released in OpenClaw 2026.4.20