PT-2026-33862 · Openclaw · Openclaw

Peng Zhou · Published 2026-04-07 · Updated 2026-04-21 · CVE-2026-41295

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2

Description An improper trust boundary issue exists where untrusted workspace channel shadows can execute during built-in channel setup and login. A malicious workspace plugin claiming a bundled channel id can achieve unintended in-process code execution before the plugin is explicitly trusted, bypassing the intended security boundary during the setup and login process.

Recommendations Update to version 2026.4.2 or later.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-41295

GHSA-2QRV-RC5X-2G2H

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41295 · Security Note
• https://osv.dev/vulnerability/GHSA-2qrv-rc5x-2g2h · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2046464338248995310 · Twitter Post
• https://vulncheck.com/advisories/openclaw-untrusted-workspace-channel-shadow-code-execution-during-built-in-channel-setup · Note
• https://twitter.com/CVEnew/status/2046571884628836468 · Twitter Post