EUVD-2026-26130Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition to tamper with plugin download
-
DeliveryServe malicious ClawHub plugin archive
-
ExploitVictim initiates plugin install
-
ExecutionIntegrity check absent, archive accepted
-
ImpactMalicious plugin code runs in local assistant
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Integrity check implementation
|
| Exploitation Conditions | Exploitation requires the victim to install or update an OpenClaw plugin through ClawHub, and the attacker to be positioned to supply a tampered or malicious plugin archive (e.g., a man-in-the-middle on the download path or control of the served package). Limiting factors: the CVSS vector requires low-level privileges (PR:L) and passive user interaction (UI:P - the user must initiate a plugin install), attack complexity is High (AC:H), and the advisory explicitly scopes the flaw to OpenClaw's single-user, user-controlled local trust model rather than a multi-tenant service boundary. It affects only OpenClaw versions before 2026.4.8; there is no exposure on a default install unless a plugin is actually being downloaded. |
| Impact | The signals point to a genuine but non-urgent issue. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) yields 7.5 (High) with total technical impact, but high attack complexity, required low-level privileges, and passive user interaction all constrain real-world exploitation. CISA SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=total - high consequence if triggered, but not currently exploited and not mass-automatable. EPSS is 0.02% (4th percentile) and the CVE is not in CISA KEV, consistent with no observed exploitation. The practical risk is a supply-chain/tampering scenario against individual users who install plugins, not a wormable remote flaw. One data conflict to verify: the linked 'patch' commit diff (d7c3210) concerns SSRF/DNS-pinning changes in the network fetch guard, not plugin-archive integrity verification, so the exact integrity-check code change is not visible in the supplied evidence. |
| Exploit ScenarioDerived | An attacker who can influence a plugin download - for example by tampering with an archive in transit or serving a substituted package to a targeted user - publishes a malicious ClawHub plugin. When the victim installs or updates the plugin, OpenClaw accepts the archive without verifying its integrity, silently deploying attacker code into the local assistant environment. The high attack complexity and passive user interaction make this a targeted rather than opportunistic attack; no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
RemediationAI
Vendor-released patch: 2026.4.8 - upgrade the 'openclaw' npm package to 2026.4.8 or later, which enforces integrity verification on ClawHub plugin downloads (verified fixed tree at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5). Until upgraded, avoid installing or updating plugins from ClawHub, and only install plugin archives obtained over a trusted channel whose integrity you can independently verify, for example by manually checking a published hash before installation; this trades convenience and access to the plugin ecosystem for safety. Run the assistant under a least-privilege local user account so a malicious plugin has limited reach, and monitor the plugin install directory for unexpected changes. Full details and fix confirmation are in the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp and https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a local, user-controlled AI assistant distributed as the npm package 'openclaw', with a plugin ecosystem delivered through 'ClawHub'. The root cause is CWE-353 (Missing Support for Integrity Check): ClawHub plugin downloads were installed without enforcing archive-level or per-file integrity metadata such as cryptographic hashes or signatures. Without that verification step the client cannot distinguish a genuine plugin archive from one altered in transit or served from a substituted source, so tampering goes undetected before the plugin is unpacked and trusted by the local environment. The single affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-delivered tampering with high complexity (AC:H) and user-initiated plugin install (UI:R); the missing integrity check lets malicious code run locally, giving full C/I/A impact, with PR:L per the operator context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Executive ViewAI
A vulnerability in OpenClaw (versions before 2026.4.8) allows attackers to inject malicious or tampered plugins that execute without verification, putting local environments and accessible data at risk. Organizations deploying OpenClaw face potential compromise if users install plugins from untrusted or intercepted sources. The threat level remains low due to minimal active exploitation and the availability of an immediate patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB