Threats tagged 'ghsa-939r-rj45-g2rj'

OpenClaw versions prior to 2026.4.9 have a vulnerability where workspace provider authentication choices could automatically enable untrusted provider plugins during non-interactive onboarding. This occurs because the system might select an auth choice shadowed by an untrusted workspace plugin, leading to unintended plugin activation. The issue is fixed in version 2026.4.9 and later.