Openclaw cli: OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup (CVE-2026-41295)
Description
OpenClaw CLI versions before 2026.4.2 have a vulnerability where untrusted workspace channel shadows could execute code during built-in channel setup. This occurs because the setup and login process could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin claiming a bundled channel ID could execute during channel setup even if disabled, bypassing the intended trust boundary.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41295 affects OpenClaw CLI versions prior to 2026.4.2. The vulnerability arises from the built-in channel setup and login process resolving untrusted workspace channel shadows before explicit trust is established. This allows a malicious workspace plugin, which claims a bundled channel ID, to execute code during channel setup despite being disabled. The issue effectively bypasses the workspace-plugin trust boundary, enabling unintended in-process code execution. The vulnerability is patched in version 2026.4.2 by ignoring untrusted workspace channel shadows during setup resolution.
Potential Impact
An attacker controlling a cloned workspace can exploit this vulnerability to execute code within the process during channel setup. This bypasses the intended security boundary that separates trusted and untrusted workspace plugins, potentially leading to unauthorized code execution within the OpenClaw CLI environment.
Mitigation Recommendations
A patch is available in OpenClaw CLI version 2026.4.2 and later. Users should upgrade to version 2026.4.2 or newer to mitigate this vulnerability. Until the patched version is published and available, users should avoid using untrusted workspace plugins or cloned workspaces that could exploit this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-41295
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245d612601ec6a3168097
Added to database: 10/04/2026, 12:25:58 UTC
Last enriched: 10/04/2026, 13:19:33 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.