Executive brief
OpenClaw is a local AI assistant application that downloads plugin packages from ClawHub. The vulnerability allows downloaded plugin archives to be installed without verifying their integrity, meaning an attacker could swap legitimate packages for malicious ones in transit and the application would accept them. This could result in arbitrary code execution within the OpenClaw environment, compromising the local system.
Technical details
The vulnerability is a missing integrity check (CWE-353) in the ClawHub package download mechanism. When OpenClaw downloads plugin archives, it does not validate the integrity of the downloaded files through checksums, signatures, or other verification mechanisms. This allows an attacker with network access (via man-in-the-middle or package repository compromise) to deliver malicious plugin archives that will be installed without detection. The attack requires user interaction to trigger the plugin download, but once triggered, arbitrary code can execute with the privileges of the OpenClaw process. The fix was implemented in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 and released in version 2026.4.8. The advisory notes this is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.
Affected products
- OpenClaw openclaw <= 2026.4.1
Timeline
- 2026-04-09: disclosed: Advisory published on GitHub
- 2026-04-08: patched: Fix released in version 2026.4.8
- 2026-04-28: other: NVD publication of CVE-2026-42428