Product
OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability (CVE-2026-43566) where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content, allowing attackers to preserve owner-like execution context.