Openclaw cli: OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins (CVE-2026-43569)

CVE-2026-43569 affects openclaw-cli versions prior to 2026.4.9. During non-interactive onboarding, the system could select a provider authentication choice that is shadowed by an untrusted workspace plugin, causing that plugin to be auto-enabled during authentication setup. The vulnerability arises because untrusted provider plugins were not properly excluded from auth choices unless explicitly enabled. The fix implemented in pull request #62368 ensures that trusted provider origins are preferred for auth choices and untrusted workspace choices are excluded unless explicitly enabled.

An attacker could exploit this vulnerability to have an untrusted provider plugin automatically enabled during the authentication setup process, potentially leading to compromise of confidentiality, integrity, and availability of the system. The CVSS 3.1 score is 8.8 (high severity), indicating a network attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Users should upgrade to openclaw-cli version 2026.4.9 or later. The issue is fixed starting from this version, with the latest npm release 2026.4.14 including the fix. No additional mitigation is required once the upgrade is applied.