CVE-2026-43569: Openclaw Authentication Bypass Flaw

CVE-2026-43569 Overview

CVE-2026-43569 is an authentication bypass vulnerability in OpenClaw versions before 2026.4.9. The flaw allows untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider authentication choices are shadowed. Attackers can craft malicious workspace plugins that get automatically selected and enabled during authentication setup without explicit user consent. The vulnerability is classified under CWE-829: Inclusion of Functionality from Untrusted Control Sphere. OpenClaw is distributed via Node.js, expanding the potential attack surface across development environments using the package.

Critical Impact
Untrusted workspace plugins can hijack the bundled provider authentication flow, gaining execution within the authenticated context without user interaction or consent.

Affected Products

OpenClaw (Node.js distribution) versions prior to 2026.4.9
Workspaces using non-interactive onboarding with provider auth choices
Environments loading bundled provider plugins alongside workspace plugins

Discovery Timeline

2026-05-05 - CVE-2026-43569 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-43569

Vulnerability Analysis

The vulnerability exists in OpenClaw's non-interactive onboarding workflow. When the system resolves provider authentication choices, it incorrectly considers untrusted workspace plugins alongside bundled, trusted plugins. A workspace plugin can shadow a legitimate provider auth choice and be auto-selected during setup.

Because the onboarding flow runs without interactive prompts, the user receives no opportunity to reject the malicious plugin. The plugin is then enabled in the configuration via enablePluginInConfig, granting it access to the authentication path and any credentials handled during provider setup.

This represents a trust boundary violation. Workspace-supplied code is treated with the same authority as bundled provider plugins despite originating from an untrusted source. CWE-829 captures this class of flaw, where functionality from an untrusted control sphere is included without sufficient validation.

Root Cause

The root cause is the absence of an includeUntrustedWorkspacePlugins boundary flag in resolveProviderPluginChoice. Without this flag, the resolver did not distinguish between bundled providers and workspace-supplied plugins when computing the preferred provider for an auth choice.

Attack Vector

An attacker who can place a plugin definition in a target workspace, for example through a poisoned repository, malicious dependency, or shared workspace folder, triggers exploitation when a victim runs non-interactive onboarding. Network delivery of the malicious workspace combined with a setup invocation by the victim is sufficient.

typescript

// Patch in src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts
 import type { OpenClawConfig } from "../../../config/config.js";
 import { enablePluginInConfig } from "../../../plugins/enable.js";
 import { resolvePreferredProviderForAuthChoice } from "../../../plugins/provider-auth-choice-preference.js";
+import { resolveManifestProviderAuthChoice } from "../../../plugins/provider-auth-choices.js";
 import type {
   ProviderAuthOptionBag,
   ProviderNonInteractiveApiKeyCredentialParams,

// Patch in src/plugins/provider-auth-choice-preference.ts
     workspaceDir: params.workspaceDir,
     env: params.env,
     mode: "setup",
+    includeUntrustedWorkspacePlugins: params.includeUntrustedWorkspacePlugins,
   });
   const pluginResolved = resolveProviderPluginChoice({
     providers,

Source: GitHub commit 2d97eae

Detection Methods for CVE-2026-43569

Indicators of Compromise

Unexpected entries in OpenClaw configuration files showing workspace-scoped provider plugins enabled after onboarding.
Provider authentication choices resolving to plugin paths inside the workspace directory rather than bundled package paths.
Outbound network requests from non-interactive onboard commands to unexpected hosts during credential setup.
Newly added plugin manifests in workspaces that were not authored by the development team.

Detection Strategies

Audit OpenClaw configuration state after each onboarding run to verify only bundled providers were enabled.
Compare plugin resolution logs against an allowlist of trusted provider plugin identifiers.
Inspect workspace directories under version control review for unexpected plugin manifests prior to running setup.

Monitoring Recommendations

Monitor process execution of openclaw CLI invocations with the onboard-non-interactive subcommand on developer endpoints and CI runners.
Log file modifications to OpenClaw configuration files and plugin manifests, alerting on changes outside expected change windows.
Track network egress from CI/CD pipelines during onboarding stages to identify unexpected destinations.

How to Mitigate CVE-2026-43569

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.9 or later across all developer workstations and CI/CD systems.
Audit all workspaces that have run non-interactive onboarding on vulnerable versions for unauthorized plugin entries.
Rotate any provider credentials that were configured through onboarding on affected versions.
Review and remove untrusted plugin manifests from shared or cloned workspaces before re-running setup.

Patch Information

The fix is delivered in OpenClaw 2026.4.9. The patch introduces an includeUntrustedWorkspacePlugins boundary flag and adds resolveManifestProviderAuthChoice to ensure workspace plugins do not shadow bundled provider auth choices during non-interactive onboarding. See the GitHub Security Advisory GHSA-939r-rj45-g2rj and the VulnCheck Advisory on OpenClaw for full remediation details.

Workarounds

Avoid running non-interactive onboarding (onboard-non-interactive) in workspaces of unknown provenance until upgraded.
Pin OpenClaw to the patched version in package.json and lockfiles to prevent regression.
Run onboarding only in interactive mode where users can confirm each provider choice.
Restrict CI/CD jobs from executing OpenClaw onboarding against attacker-controllable repository content.

bash

# Upgrade OpenClaw to the patched release
npm install openclaw@^2026.4.9

# Verify installed version
npx openclaw --version

# Audit for unexpected plugins enabled in your config
grep -R "plugins" .openclaw/ ~/.config/openclaw/