CVE-2026-43532

High

Description

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

SeverityHigh

CVSS7.7

Exploit probability—

ProductOpenclaw

PublishedMay 5, 2026

First seenMay 5, 2026

Weakness typeCWE-184CWE-184

How to fix

Update

openclaw openclaw2026.4.10 or later
openclaw2026.4.10 or later

Patches

github.com/openclaw/openclaw/commit/979c6f09d6fad96596feb91c905934be7e0b4f15

Vendor advisories

github.com/openclaw/openclaw/security/advisories/GHSA-c9h3-5p7r-mrjh

Affected products

Product	Affected versions	Fixed in
openclaw openclaw	2026.4.7 ≤ v < 2026.4.10	2026.4.10
openclawnpm	2026.4.7 ≤ v < 2026.4.10	2026.4.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.