GitHub Advisoryadvisory · npm

GHSA-939r-rj45-g2rj OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

HIGH Published 2026-04-17 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-43569
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-829
Reviewed
2026-04-17

Affected packages

• npm openclaw: < 2026.4.9 → fixed in 2026.4.9

Description

Summary Workspace provider auth choices could auto-enable untrusted provider plugins. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `= 2026.4.9` Impact Non-interactive onboarding could select a provider auth choice shadowed by an untrusted workspace plugin, auto-enabling that plugin during auth setup. Technical Details The fix prefers trusted provider origins for auth choices and excludes untrusted workspace choices unless they are explicitly enabled. Fix The issue was fixed in #62368. The first stable tag containing the fix is `v2026.4.9`, and `[email protected]` includes the fix. Fix Commit(s) • `2d97eae53e212ae26f3aebcd6a50ffc6877f770d` • PR: #62368 Release Process Note Users should upgrade to `openclaw` 2026.4.9 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @zpbrent for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-43569 OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during… vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References