Which versions of OpenClaw are affected by EUVD-2026-27289?

OpenClaw versions before 2026.4.9 contain an authentication bypass vulnerability that allows malicious workspace plugins to intercept and redirect provider credentials during onboarding, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-27289?

Within 24 hours: Identify all OpenClaw deployments and document current versions in use. Within 7 days: Upgrade all OpenClaw instances to version 2026.4.9 or later; validate patch deployment across non-production and production environments. Within 30 days: Audit workspace plugin sources and permissions; implement plugin allowlist policies to restrict untrusted provider integrations; review authentication logs for suspicious credential interception patterns.

OpenClaw EUVD-2026-27289

Q: What is the CVSS score of EUVD-2026-27289?

EUVD-2026-27289 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-43569 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-05-05 VulnCheck

GHSA-939r-rj45-g2rj

Authentication Bypass Openclaw

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

8.8 (HIGH) 7.7 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:20 vuln.today

Analysis Generated

May 05, 2026 - 12:20 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.9.

DescriptionCVE.org

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are automatically selected and enabled during authentication setup without explicit user consent.

AnalysisAI

Authentication bypass in OpenClaw before 2026.4.9 enables untrusted workspace plugins to intercept provider authentication credentials during non-interactive onboarding. Malicious plugins can shadow legitimate provider authentication choices, causing the system to auto-enable attacker-controlled code and route sensitive API keys or credentials through untrusted handlers without user consent. Vendor-released patch available (v2026.4.9+). EPSS and KEV data not provided; exploitation requires user interaction (UI:P) and specific attack timing (AT:P), suggesting moderate real-world deployment complexity despite network attack vector.

Technical ContextAI

This vulnerability affects OpenClaw's plugin-based provider authentication system, specifically the non-interactive onboarding flow for workspace configurations. The flaw stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) where the application failed to validate the trust boundary of provider authentication plugins. During automated setup, OpenClaw's provider resolution logic would accept auth choice IDs from workspace-scoped plugins without verifying they originated from bundled, trusted providers. An attacker could register a workspace plugin with provider auth choice IDs matching legitimate providers (e.g., 'openai-api-key'), causing the system to route authentication credentials to the malicious plugin's handlers. The affected package is the npm distribution 'openclaw' (cpe:2.3:a:openclaw:openclaw), versions prior to 2026.4.9. The fix introduced trust-aware filtering in resolvePluginProviders(), setting includeUntrustedWorkspacePlugins:false during setup mode and preferring bundled provider origins over workspace-defined choices unless explicitly trusted by the user.

RemediationAI

Upgrade to OpenClaw version 2026.4.9 or newer immediately; vendor recommends 2026.4.14 as the latest stable release containing the fix. Installation via npm: 'npm install openclaw@2026.4.14' or update package.json dependency constraint. Vendor advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-939r-rj45-g2rj. Fix implemented in commit 2d97eae53e212ae26f3aebcd6a50ffc6877f770d and PR #62368, which modified provider resolution logic to exclude untrusted workspace plugins during authentication setup unless explicitly enabled. For deployments unable to patch immediately: (1) Disable non-interactive onboarding workflows and require manual provider authentication setup with visual confirmation of provider origin; (2) Implement workspace plugin allow-listing at the infrastructure level, blocking execution of any workspace-scoped plugins not pre-approved; (3) Audit existing workspace configurations for unexpected provider plugin registrations using 'grep -r provider.*auth workspace/.openclaw/'. These mitigations reduce automation convenience and require manual oversight, creating operational friction in CI/CD pipelines. Long-term: establish organizational policy requiring plugin signature verification before workspace deployment.