VULNERABILITY INTELLIGENCE

CVE-2026-43571

CVSS score7.7 HIGH
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-05-05
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

Weakness classification

  • CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Primary references