Openclaw cli: OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification (CVE-2026-42428)
Description
OpenClaw CLI versions up to 2026.4.1 do not enforce integrity verification on ClawHub package downloads, allowing installation of plugin archives without validating archive or per-file integrity metadata. This vulnerability affects the local user-controlled assistant OpenClaw and does not involve multi-tenant service boundaries. The issue has been fixed in version 2026.4.8.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42428 describes a vulnerability in the OpenClaw CLI where ClawHub package downloads lack enforced integrity verification. This allows potentially unverified plugin archives to be installed, bypassing checks on archive or per-file integrity metadata. The vulnerability affects versions of the openclaw npm package from 2026.1.29 up to but not including 2026.4.8. The fix was implemented on the main branch and released in version 2026.4.8, with regression tests confirming the resolution.
Potential Impact
An attacker could supply malicious plugin archives that are installed without integrity verification, potentially leading to compromise of confidentiality, integrity, and availability of the local OpenClaw assistant environment. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and user interaction with low privileges.
Mitigation Recommendations
Users should upgrade to openclaw version 2026.4.8 or later, where the integrity verification enforcement for ClawHub package downloads has been implemented. No additional mitigation is required as the issue is fixed in the official release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-42428
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245d512601ec6a3168087
Added to database: 10/04/2026, 12:25:57 UTC
Last enriched: 10/04/2026, 13:18:15 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.