Which versions of OpenClaw are affected by CVE-2026-43571?

CVE-2026-43571 in OpenClaw allows authenticated network attackers to bypass plugin trust verification during setup, enabling arbitrary code execution within the OpenClaw runtime environment.. A patch is available.

How to fix or mitigate CVE-2026-43571?

Within 24 hours: Identify all OpenClaw instances in your environment and document current versions. Within 7 days: Apply vendor patch to OpenClaw version 2026.4.10 or later across all deployments; prioritize production systems first. Within 30 days: Audit workspace plugin configurations to detect and remove any suspicious or unauthorized plugins created since deployment; implement plugin signing and allowlisting controls to restrict future plugin installations.

OpenClaw CVE-2026-43571

Q: What is the CVSS score of CVE-2026-43571?

CVE-2026-43571 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27293 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-05-05 VulnCheck

GHSA-82qx-6vj7-p8m2

Authentication Bypass Openclaw

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

8.8 (HIGH) 7.7 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:20 vuln.today

Analysis Generated

May 05, 2026 - 12:20 vuln.today

DescriptionCVE.org

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

AnalysisAI

OpenClaw's channel setup catalog lookup mechanism allowed workspace plugins to shadow bundled channel plugins and bypass trust gates during setup-time plugin loading. Low-privileged authenticated attackers on the network can craft malicious workspace plugins that execute without the intended trust verification, enabling arbitrary code execution in the OpenClaw runtime. The vulnerability was responsibly disclosed by security researchers from Keen Security Lab and patched in version 2026.4.10. No public exploit identified at time of analysis, though the fix commit reveals the exact vulnerable lookup logic attackers would target.

Technical ContextAI

OpenClaw is an npm-based platform that loads plugins during channel setup operations. The vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The channel setup catalog lookup used listChannelPluginCatalogEntries() which searched workspace-scoped plugin directories before bundled plugins, without enforcing the excludeWorkspace flag or checking against the trusted catalog (plugins.allow config). This created a search-order hijacking scenario where an attacker-controlled workspace plugin could resolve before the legitimate bundled channel plugin, bypassing the trust gate that normally restricts workspace plugin loading. The fix introduced listSetupDiscoveryChannelPluginCatalogEntries() and listTrustedChannelPluginCatalogEntries() functions that explicitly route setup catalog lookups through trusted paths with excludeWorkspace: true, and added getTrustedChannelPluginCatalogEntry() that falls back to bundled plugins when workspace shadows are untrusted. The affected component is the channel setup discovery module (src/commands/channel-setup/discovery.ts) and plugin installation logic (src/commands/channel-setup/plugin-install.ts).

RemediationAI

Upgrade openclaw npm package to version 2026.4.10 or later, with version 2026.4.14 being the current stable release containing the fix. The patch commit 1fede43b948df40ca8674511d4bd08d39f6c5837 is available at https://github.com/openclaw/openclaw/commit/1fede43b948df40ca8674511d4bd08d39f6c5837. The fix routes setup catalog lookups through trusted paths using listSetupDiscoveryChannelPluginCatalogEntries() and listTrustedChannelPluginCatalogEntries() with excludeWorkspace flag enforced, and modifies discovery.ts and plugin-install.ts to prevent workspace shadows from bypassing trust gates. Full vendor advisory with upgrade guidance is at https://github.com/openclaw/openclaw/security/advisories/GHSA-82qx-6vj7-p8m2. If immediate upgrade is not feasible, implement strict workspace directory access controls to prevent untrusted users from writing plugin files, and explicitly configure the plugins.allow allowlist to only include verified bundled or explicitly trusted workspace plugins. Audit existing workspace plugin directories for unexpected or unrecognized plugin shadows. Note that restricting workspace write access may impact legitimate development workflows where users need to test custom plugins.