OpenClaw prior to version 2026.4.9 allows an authentication bypass whereby untrusted workspace plugins can be automatically enabled during non‑interactive onboarding when provider authentication choices are shadowed. An attacker can craft a malicious plugin that is selected and activated without the user’s explicit consent, effectively granting the plugin undeserved execution rights. This bypass of user approval constitutes a breach of integrity and can lead to covert code execution within the trusted environment.

The vulnerability affects the OpenClaw open‑source project, specifically all releases older than 2026.4.9. Users running those versions are exposed to the risk of malicious workspace plugins being enabled automatically during onboarding.

The CVSS score of 7.7 indicates a high severity of this flaw. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, implying that widespread, documented exploitation has not yet been observed. The likely attack vector is remote: an attacker who can deliver a malicious plugin to a user’s workspace will trigger auto‑enablement during the provider authentication process, potentially compromising the workspace without user awareness. The impact is significant because it permits execution of an untrusted module, aligning with CWE‑829.