OpenClaw before version 2026.4.10 contains a plugin trust bypass that allows the channel setup catalog to resolve workspace plugin shadows before the bundled channel plugins. This flaw means that an attacker can craft a malicious workspace plugin that is loaded during setup with elevated trust, potentially enabling the execution of untrusted code within the channel setup process. The weakness is categorized as CWE-829.

The affected product is OpenClaw, with any release earlier than 2026.4.10. It uses a Node.js environment. No other vendor or product details are listed beyond the OpenClaw product line.

The CVSS score of 7.7 reflects a high severity risk, but the EPSS score is not provided, so the current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploit would likely involve an attacker feeding a malicious workspace plugin into a channel that is being set up, causing the plugin loader to execute that plugin before loading the safe bundled plugins. The attack vector is inferred to require an ability to modify or place files in the workspace plugin directory, which could be achieved with local or remote access that allows such modifications.