CVE-2026-43574

6.0 mediumEPSS 0.2%

Medium (6.0) in openclaw openclaw. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openclaw 2026.4.12.

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-183
Published: 2026-05-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclaw:openclaw

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-49cg-279w-m73x	npm	openclaw	<2026.4.12	2026.4.12

References

https://github.com/openclaw/openclaw/commit/0a105c0900de701d2ee9f1abc96b017afbd0afdd
https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x
https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-empty-approver-lists

Check your stack JSON