Technical impact
OpenClaw versions prior to 2026.4.20 fail to preserve untrusted labels for isolated cron awareness events, causing webhook‑triggered cron agent output to be recorded as trusted system events. This flaw allows attackers to elevate the trust level of malicious data, facilitating stronger prompt‑injection attacks that treat untrusted events as legitimate system events. The weakness is rooted in improper neutralization of trust boundaries (CWE‑345).
Affected Systems
The vulnerability affects all OpenClaw products under the vendor name OpenClaw, specifically versions before 2026.4.20. Users running 2026.4.19 or older are at risk.
Risk and Exploitability
The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, suggesting no current data on exploitation probability, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw by sending malicious webhook payloads that trigger isolated cron events; these events are then marked as trusted, enabling the attacker to inject commands or prompts that the system would otherwise reject. The attack vector is likely remote through webhooks, making the flaw exploitable over the network if the webhook interface is reachable.
Github GHSA