A vulnerability in the openclaw npm package versions 2026.4.7 through 2026.4.13 allows heartbeat owner downgrade logic to skip untrusted webhook wake events. This flaw preserves an owner-like execution context when the run should have been downgraded, potentially leading to unauthorized elevated privileges. The issue is fixed in version 2026.4.14.