OpenClaw CVE-2026-41295

Successful exploitation requires the victim to clone a workspace from an attacker-controlled repository using OpenClaw versions before 2026.4.2. The vulnerability specifically triggers during the built-in channel setup and login phase of workspace initialization, meaning default workspace clone operations are vulnerable without requiring non-standard configuration changes. User interaction is mandatory (UI:P in CVSS vector): the victim must actively initiate the workspace clone action, providing natural friction against automated exploitation. No authentication is required to deliver the malicious workspace (PR:N), as public Git repositories are accessible to anonymous users. The attack does NOT require elevated privileges on the victim's system-standard user permissions suffice for OpenClaw operation. Exploitation is limited to the local context where OpenClaw runs (AV:L), meaning the attacker cannot remotely trigger the vulnerability without first convincing the victim to clone the workspace. Organizations that restrict workspace sources to internal Git servers or maintain allowlists of trusted repository URLs effectively prevent this attack vector regardless of OpenClaw version.

Risk profile shows notable divergence between theoretical severity and practical exploitation likelihood. CVSS 8.5 (High) reflects legitimate impact potential: the vulnerability grants complete compromise of confidentiality, integrity, and availability within the vulnerable component (VC:H/VI:H/VA:H) with no scope change (SC:N/SI:N/SA:N). However, multiple risk signals indicate limited real-world threat urgency. EPSS exploitation probability of 0.01% (2nd percentile) suggests security researchers assess near-zero likelihood of widespread exploitation. CISA SSVC framework confirms no current exploitation activity, classifies the vulnerability as non-automatable (requires social engineering to trick users into cloning malicious workspaces), and notes total technical impact. The attack chain requires convincing developers to clone a workspace from an untrusted source-feasible in supply chain scenarios but not opportunistic mass exploitation. Patch availability from vendor (commit 53c29df2 fixing the trust boundary issue) and absence of public proof-of-concept code further reduce urgency. Primary risk exists in environments where developers routinely clone workspaces from semi-trusted or public sources without vetting, particularly in open-source contribution workflows. Organizations should prioritize patching based on OpenClaw usage patterns: high priority if used with external workspace repositories, moderate priority for internal-only deployments with workspace source controls already in place.

An attacker creates a malicious OpenClaw workspace repository on a public Git hosting service, embedding a plugin that claims a built-in channel ID reserved for trusted core functionality. The attacker socially engineers a target developer through phishing, issue comments, or pull request discussions to clone this workspace for review or collaboration. When the victim executes the workspace clone operation in OpenClaw, the malicious plugin's channel shadow activates during the built-in channel setup phase-before the application's trust verification prompt appears. The attacker's code now executes with full OpenClaw process privileges, enabling data exfiltration from the workspace, credential theft from memory, or persistence mechanism installation. No public proof-of-concept code has been identified at time of analysis, but the attack primitive is straightforward for adversaries familiar with OpenClaw's plugin architecture.