PT-2026-33862

CVE-2026-41295

Published

2026-04-07

Updated

2026-04-21

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2

Description An improper trust boundary issue exists where untrusted workspace channel shadows can execute during built-in channel setup and login. A malicious workspace plugin claiming a bundled channel id can achieve unintended in-process code execution before the plugin is explicitly trusted, bypassing the intended security boundary during the setup and login process.

Recommendations Update to version 2026.4.2 or later.

Exploitability

Exploit

Fix

Researchers

Peng Zhou

Vendors

Affected products

Weakness enumeration

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related identifiers

CVE-2026-41295