Medium 5.3Published May 11, 2026

CVE-2026-44999OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events

Updated under an hour ago (Oct 28, 2026, 11:40 AM ET)

Does this affect you?

It affects OpenClaw. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OpenClaw

Exploited in the last 30 days

OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted system events. Attackers can exploit this trust-labeling issue to strengthen prompt-injection attacks by rendering untrusted events as trusted System events.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

OpenClaw OpenClaw openclaw:openclaw (from the name)	before 2026.4.20; 2026.4.20 not affected	CNA record
openclaw openclaw openclaw:openclaw	before 2026.4.20	NVD

References

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-57r2-h2wj-g887	vendor-advisory, third-party-advisory
https://github.com/openclaw/openclaw/commit/f61896b03cc7031f51106a04566831f4ac2a0bd7	patch
https://www.vulncheck.com/advisories/openclaw-improper-trust-labeling-in-isolated-cron-awareness-events	third-party-advisory, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.