CVE-2026-41295: OpenClaw RCE Vulnerability

CVE-2026-41295 Overview

CVE-2026-41295 is an improper trust boundary vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) affecting OpenClaw versions before 2026.4.2. The vulnerability allows untrusted workspace channel shadows to execute during built-in channel setup and login operations. An attacker can clone a workspace containing a malicious plugin that claims a bundled channel ID, achieving unintended in-process code execution before the plugin is explicitly trusted by the user.

Critical Impact

This vulnerability enables arbitrary code execution through malicious workspace plugins that bypass the trust verification process, potentially compromising developer environments and CI/CD pipelines.

Affected Products

• OpenClaw versions prior to 2026.4.2

Discovery Timeline

• 2026-04-21 - CVE-2026-41295 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2026-41295

Vulnerability Analysis

This improper trust boundary vulnerability exists in OpenClaw's channel plugin resolution mechanism. The core issue stems from the application's failure to properly validate the origin and trust status of workspace channel shadows before allowing them to execute during the built-in channel setup process. When a user clones or opens a workspace, the channel setup routine processes plugins associated with channel IDs without verifying whether these plugins originate from trusted sources or the official plugin catalog.

The vulnerability is particularly dangerous because code execution occurs during the initial setup phase—before any user interaction or explicit trust approval can take place. This creates an attack window where malicious code runs with the full privileges of the OpenClaw process simply by opening a compromised workspace.

Root Cause

The root cause lies in the channel plugin catalog and resolution components failing to track and validate plugin origins during channel setup. The ChannelPluginCatalogEntry type lacked an origin field to distinguish between bundled/trusted plugins and workspace-provided shadows. Additionally, the channel plugin resolution logic in channel-plugin-resolution.ts did not incorporate the plugin configuration state normalization and trust verification functions before resolving and executing channel plugins.

Attack Vector

The attack requires local access with user interaction—specifically, the victim must clone or open a malicious workspace. An attacker prepares a workspace repository containing a crafted plugin that declares a channel ID matching a bundled/built-in channel. When the victim opens this workspace, OpenClaw's channel setup routine encounters the malicious plugin shadow and executes it instead of (or alongside) the legitimate bundled channel, achieving code execution within the OpenClaw process context.

// Security patch adding origin tracking to ChannelPluginCatalogEntry
// Source: https://github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0

 export type ChannelPluginCatalogEntry = {
   id: string;
   pluginId?: string;
+  origin?: PluginOrigin;
   meta: ChannelMeta;
   install: {
     npmSpec: string;

The patch introduces an origin field to track the source of each plugin, enabling the system to distinguish between trusted bundled plugins and untrusted workspace-provided shadows.

// Security patch adding trust verification imports to channel-plugin-resolution.ts
// Source: https://github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0

 import { getChannelPlugin, normalizeChannelId } from "../../channels/plugins/index.js";
 import type { ChannelId, ChannelPlugin } from "../../channels/plugins/types.js";
 import type { OpenClawConfig } from "../../config/config.js";
+import { normalizePluginsConfig, resolveEnableState } from "../../plugins/config-state.js";
 import type { RuntimeEnv } from "../../runtime.js";
 import { createClackPrompter } from "../../wizard/clack-prompter.js";
 import type { WizardPrompter } from "../../wizard/prompts.js";

This change imports the necessary functions to normalize plugin configurations and resolve trust/enable states before allowing plugin execution.

Detection Methods for CVE-2026-41295

Indicators of Compromise

• Unexpected plugin files or configurations in workspace directories claiming bundled channel IDs
• Process execution anomalies during OpenClaw startup or workspace opening operations
• Unusual network connections or file system access initiated by OpenClaw processes immediately after opening a workspace

Detection Strategies

• Monitor workspace .openclaw configuration directories for plugins that reference built-in channel identifiers
• Implement file integrity monitoring on OpenClaw installation directories to detect unauthorized plugin loading
• Review recent workspace clone operations and correlate with any suspicious process behavior

Monitoring Recommendations

• Enable verbose logging for OpenClaw channel setup and plugin resolution operations
• Audit all externally-sourced workspaces before opening them in development environments
• Deploy endpoint detection and response (EDR) solutions to monitor for anomalous behavior during application startup sequences

How to Mitigate CVE-2026-41295

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.2 or later immediately
• Review any recently cloned workspaces from untrusted sources for suspicious plugin configurations
• Avoid opening workspaces from unknown or untrusted repositories until the patch is applied

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.2. The security fix introduces origin tracking for channel plugins and enforces trust verification during the channel setup process. Technical details of the patch are available in the GitHub Commit. Additional context is provided in the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Manually inspect workspace plugin configurations before opening untrusted projects
• Configure OpenClaw to prompt for explicit plugin trust approval before any plugin execution
• Use isolated development environments or containers when working with workspaces from external sources

# Configuration example - Restrict plugin loading to trusted sources only
# Add to openclaw.config.js or equivalent configuration file
export OPENCLAW_PLUGIN_TRUST_MODE="explicit"
export OPENCLAW_IGNORE_WORKSPACE_SHADOWS="true"