PT-2026-35806 · Openclaw · Openclaw

Kexna · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-42428

NVD

CVSS v3.1

7.1

High

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

Fix

Weakness Enumeration

CWE-353

Related Identifiers

CVE-2026-42428

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42428 · Security Note
• https://vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads · Note
• https://twitter.com/CVEnew/status/2049227496135008274 · Twitter Post