Which versions of OpenClaw are affected by CVE-2026-41295?

OpenClaw versions prior to 2026.4.2 contain a critical remote code execution vulnerability in workspace channel initialization that allows attackers to execute arbitrary code by convincing users to…. A patch is available.

How to fix or mitigate CVE-2026-41295?

Within 24 hours: Identify all OpenClaw installations and verify versions currently deployed; notify users not to open untrusted or cloned workspaces pending remediation. Within 7 days: Apply vendor patch by updating to OpenClaw 2026.4.2 or later, or manually apply GitHub commit 53c29df if immediate upgrade is not feasible; test patched version in non-production environment first. Within 30 days: Audit workspace configurations for suspicious channel setups; conduct security awareness training on social engineering risks associated with workspace cloning.

OpenClaw CVE-2026-41295

Q: What is the CVSS score of CVE-2026-41295?

CVE-2026-41295 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-21 disclosure@vulncheck.com

RCE Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:38 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.2.

DescriptionCVE.org

OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setup and login. Attackers can clone a workspace with a malicious plugin claiming a bundled channel id to achieve unintended in-process code execution before the plugin is explicitly trusted.

AnalysisAI

Malicious workspace plugins in OpenClaw versions before 2026.4.2 achieve arbitrary code execution by shadowing built-in channel IDs during workspace clone and setup operations. The vulnerability exploits a trust boundary flaw (CWE-829) where untrusted plugins execute before explicit user trust confirmation, requiring only that a victim clone a poisoned workspace repository. With CVSS 8.5 (High) and local attack vector requiring user interaction, real-world risk is moderate: EPSS probability sits at 0.01% (2nd percentile) with no confirmed active exploitation (not in CISA KEV), and SSVC assessment classifies it as non-automatable with total technical impact but no current exploitation.

Technical ContextAI

This vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where OpenClaw's plugin architecture fails to properly isolate untrusted code during the critical workspace initialization phase. The attack exploits the channel registration mechanism: OpenClaw uses 'channels' as communication boundaries between the core application and plugins, with certain channel IDs reserved for built-in trusted functionality. The vulnerability allows an attacker-controlled workspace to include a malicious plugin that claims a bundled (built-in) channel identifier during the workspace clone and setup process. Because the channel shadow occurs before the plugin trust verification step, the malicious code executes with the privileges of the OpenClaw process despite never receiving explicit user approval. This represents a time-of-check/time-of-use (TOCTOU) variant where the trust decision occurs after the code execution boundary has already been crossed. The local attack vector (AV:L) with user interaction (UI:P) indicates the victim must actively clone the malicious workspace, but once cloned, exploitation requires low complexity (AC:L) with no additional privileges (PR:N).

RemediationAI

Upgrade immediately to OpenClaw 2026.4.2 or later, which implements proper trust boundary enforcement before channel registration during workspace setup (fixed in commit 53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0). Vendor advisory available at https://github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h. For environments unable to upgrade immediately, implement workspace source allowlisting: configure OpenClaw to only clone workspaces from explicitly trusted repository URLs or internal Git servers, blocking arbitrary external workspace sources (trade-off: prevents legitimate external collaboration workflows). Alternatively, disable automatic plugin loading during workspace clone operations if the application supports a manual plugin approval mode (trade-off: requires additional user steps for legitimate plugin installation, may break automated workspace setup scripts). As a detective control, enable audit logging for workspace clone events and plugin registration attempts to identify potential exploitation attempts, though this provides no preventive protection. VulnCheck advisory with additional technical details available at https://www.vulncheck.com/advisories/openclaw-untrusted-workspace-channel-shadow-code-execution-during-built-in-channel-setup.