CVE-2026-44999
Openclaw ≤ 2026.4.20
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-44999 is a medium-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Openclaw Openclaw. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29144
Vulnerability Data
OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted system events. Attackers can exploit this trust-labeling issue to strengthen prompt-injection attacks by rendering untrusted events…
more
as trusted System events.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-345 enables mislabeling of untrusted webhook/cron data as trusted, directly facilitating content/prompt injection (T1659) and cron-based execution (T1053.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 8 hardening rules · 5 OS baselines
V3.5.5
Mitigating Controls (NIST 800-53 r5) AI
Directly requires preservation and enforcement of security attributes (trust labels) on data objects so untrusted webhook/cron events cannot be recorded or processed as trusted system events.
Enforces information flow policies based on security attributes, blocking the mixing of untrusted cron/webhook output into trusted event streams used for prompt injection.
Requires reliable transmission and binding of security/privacy attributes with data, mitigating loss of trust labels when events cross webhook or cron boundaries.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing or weak data authenticity verification.
Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.
Secure network services often include authenticity checks for data exchanged over those services.
Cryptographic mechanisms directly verify data origin and integrity, preventing acceptance of unauthentic data.
Secure SDLC incorporates authenticity verification requirements throughout development.
Application security requirements can mandate data authenticity verification mechanisms.