7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43569

CVE-2026-43569: OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are automatically selected and enabled during authentication setup without explicit user consent.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43569

CVE-2026-43569:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.9	2026.4.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw (CVE-2026-43569) stemmed from a failure to properly distinguish between trusted (e.g., bundled, user-configured) and untrusted (workspace-specific) plugin providers during non-interactive authentication setup. An attacker could craft a malicious workspace plugin that defined an authentication provider choice with an ID identical to a legitimate, trusted provider (e.g., 'openai-api-key').

When a user or an automated script initiated a non-interactive onboarding process using this choice ID, the system would not prioritize the trusted provider. Instead, it could resolve to the malicious workspace plugin. This would trigger the auto-enabling of the untrusted plugin, potentially allowing it to intercept sensitive credentials or execute unauthorized actions.

The core of the issue was in functions responsible for resolving and selecting these authentication providers, such as applyNonInteractivePluginProviderChoice and resolveManifestProviderAuthChoices. These functions lacked the necessary logic to check the origin of a plugin and prioritize trusted sources.

The patch addresses this by implementing a clear priority system based on the plugin's origin (config > bundled > global > workspace). It modifies the provider discovery and selection functions to filter out untrusted workspace plugins by default during setup and to always prefer choices from more trusted origins when ID collisions occur. This ensures that even if a malicious workspace plugin tries to shadow a legitimate provider, the trusted provider will be selected, mitigating the risk.

Vulnerable functions

applyNonInteractivePluginProviderChoice

src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts

This function orchestrates the non-interactive onboarding process. The vulnerability lies in its previous implementation which could resolve and select a provider from an untrusted workspace plugin without explicit user consent. This could lead to the auto-enabling of a malicious plugin. The fix introduces a strict check (`includeUntrustedWorkspacePlugins: false`) to ensure that only trusted providers are considered during the setup phase, preventing the untrusted plugin from being selected.

resolveManifestProviderAuthChoices

src/plugins/provider-auth-choices.ts

This function resolves all available provider authentication choices from various plugin manifests. The vulnerability was that it did not prioritize choices from trusted origins (like bundled or configuration plugins) over untrusted ones (workspace plugins). An attacker could create a workspace plugin with an auth choice ID that collides with a trusted one, leading to the untrusted one being selected. The fix introduces a priority system based on plugin origin to prevent this shadowing.

resolveManifestProviderAuthChoice

src/plugins/provider-auth-choices.ts

This function resolves a single authentication choice by its ID. It was vulnerable because it would return the first match found, without considering the trust level of the plugin providing the choice. An untrusted workspace plugin could therefore hijack an authentication flow by defining a choice with a well-known ID. The fix ensures that the most trusted provider is chosen from among candidates with the same choice ID by using an origin-based priority.

resolveDiscoveredProviderPluginIds

src/plugins/providers.ts

This function discovers available provider plugin IDs. The original implementation could include untrusted workspace plugins in the list of providers available for setup, even if they were not explicitly enabled. This created an opportunity for them to be selected in a non-interactive flow. The fix adds explicit filtering to exclude untrusted workspace plugins from the discovery process during setup unless they are already trusted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.