CVE-2026-42428

OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Description
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

Analysis

AI-generated

Technical impact

OpenClaw versions prior to 2026.4.8 do not verify the integrity of downloaded plugin archives, allowing attackers to inject malicious or tampered packages. This flaw enables the execution of arbitrary code within the local assistant environment, compromising confidentiality, integrity, and availability. The weakness is categorized as CWE-353, missing integrity verification.

Affected Systems

All installations of OpenClaw with a version earlier than 2026.4.8 are affected. The vulnerability pertains specifically to the OpenClaw product bundled with Node.js runtime.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers could exploit this flaw by delivering a rogue plugin archive to a user or system that auto‑installs plugins, or by modifying existing archives. Successful exploitation would allow local code execution and full compromise of the affected environment.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.4.8 or later to enable mandatory integrity verification on plugin downloads.
  • If an upgrade is not immediately possible, disable automatic plugin installation or restrict installations to trusted, verified sources.
  • When installing plugins manually, verify the cryptographic signature or hash of the archive before proceeding and reject any that fail verification.

Generated by OpenCVE AI on April 28, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-3vvq-q2qc-7rmp OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Title OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-353
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-353

    Missing Support for Integrity Check

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Apr 29, 2026, 12:14 PM
Reserved
Apr 27, 2026, 11:38 AM

View source JSON

Updated
Apr 29, 2026, 12:14 PM

JSON

Status
Analyzed
Published
Apr 28, 2026, 7:37 PM
Modified
Nov 11, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 28, 2026, 11:00 PM

JSON