PT-2026-37026 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-17 · Updated 2026-05-05 · CVE-2026-43571

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description A plugin trust bypass exists where channel setup catalog lookups may resolve workspace plugin shadows before bundled channel plugins. This allows attackers to craft malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

Recommendations Update to version 2026.4.10 or newer.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-829

Related Identifiers

CVE-2026-43571

GHSA-82QX-6VJ7-P8M2

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/commit/1fede43b948df40ca8674511d4bd08d39f6c5837 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-82qx-6vj7-p8m2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-82qx-6vj7-p8m2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43571 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://t.me/CVEtracker/52741 · Telegram Post
• https://vulncheck.com/advisories/openclaw-untrusted-workspace-plugin-shadow-resolution-in-channel-setup · Note