Description
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Published: 2026-04-28
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Local code execution via tampered plugin installation
Action: Apply Patch
AI Analysis

Impact

OpenClaw versions prior to 2026.4.8 do not verify the integrity of downloaded plugin archives, allowing attackers to inject malicious or tampered packages. This flaw enables the execution of arbitrary code within the local assistant environment, compromising confidentiality, integrity, and availability. The weakness is categorized as CWE-353, missing integrity verification.

Affected Systems

All installations of OpenClaw with a version earlier than 2026.4.8 are affected. The vulnerability pertains specifically to the OpenClaw product bundled with Node.js runtime.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers could exploit this flaw by delivering a rogue plugin archive to a user or system that auto‑installs plugins, or by modifying existing archives. Successful exploitation would allow local code execution and full compromise of the affected environment.

Generated by OpenCVE AI on April 28, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.4.8 or later to enable mandatory integrity verification on plugin downloads.
  • If an upgrade is not immediately possible, disable automatic plugin installation or restrict installations to trusted, verified sources.
  • When installing plugins manually, verify the cryptographic signature or hash of the archive before proceeding and reject any that fail verification.

Generated by OpenCVE AI on April 28, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Description OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Title OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-353
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-29T12:14:50.350Z

Reserved: 2026-04-27T11:38:59.195Z

Link: CVE-2026-42428

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-28T19:37:46.630

Modified: 2026-04-28T20:10:23.367

Link: CVE-2026-42428

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T23:00:13Z

Weaknesses