Vulnerabilities

TI-2026-31703 CVE-2026-43569 · GHSA-939r-rj45-g2rj

OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth

LOW 36

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00376 Published 2026-05-05 Fixed in 2026.4.9 CWE-829

TI-2026-31695 CVE-2026-43531 · GHSA-7wv4-cc7p-jhxc

OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

LOW 32

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00203 Published 2026-05-05 Fixed in 2026.4.9 CWE-15

Vulnerabilities

Filters

OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth

OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File