OpenClaw products prior to version 2026.4.2 contain an improper trust boundary flaw that allows an untrusted workspace channel shadow to be executed during built‑in channel setup and login. An attacker can clone a workspace and include a malicious plug‑in that claims a bundled channel ID, causing the code to run in the process before the plug‑in is explicitly trusted. The impact is that arbitrary code runs with the same privileges as the OpenClaw application, potentially compromising confidentiality, integrity, and availability of the system on which OpenClaw is installed.

All OpenClaw installations running versions older than 2026.4.2 are vulnerable. The affected product is the OpenClaw application distributed by OpenClaw, available for Node.js environments.

The CVSS score of 8.5 classifies this flaw as High severity, and the lack of an EPSS score means the likelihood of exploitation is undetermined but the vulnerability is well documented. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is an attacker who can create or clone a workspace and supply a malicious plug‑in that claims a bundled channel ID, forcing the code to execute during the built‑in channel setup. A successful exploit would allow in‑process code execution prior to the plug‑in being explicitly trusted.