7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43571

CVE-2026-43571: OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43571

CVE-2026-43571:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of channel plugin discovery during the setup process. The functions resolveChannelSetupEntries, resolveScopedChannelPluginId, and setupChannels all relied on catalog lookup functions (listChannelPluginCatalogEntries and getChannelPluginCatalogEntry) that did not differentiate between trusted, bundled plugins and untrusted plugins located in the workspace. This allowed for a 'workspace plugin shadow' attack, where a malicious plugin in the workspace could impersonate a legitimate one.

The patch addresses this by introducing a new layer of trust verification. The new file src/commands/channel-setup/trusted-catalog.ts exports functions like listTrustedChannelPluginCatalogEntries and getTrustedChannelPluginCatalogEntry. These functions wrap the original catalog lookup functions and check if a workspace plugin is explicitly trusted in the configuration. If a workspace plugin is not in the allowlist, the functions fall back to using only the bundled plugins by calling the original functions with an excludeWorkspace: true option. The vulnerable functions were then updated to use these new trusted lookup functions, ensuring that only trusted plugins are considered during channel setup.

Vulnerable functions

resolveChannelSetupEntries

src/commands/channel-setup/discovery.ts

The `resolveChannelSetupEntries` function was vulnerable because it used `listChannelPluginCatalogEntries` to discover channel plugins. This function did not distinguish between trusted bundled plugins and potentially malicious workspace plugins. An attacker could create a workspace plugin that shadows a legitimate channel plugin, and `resolveChannelSetupEntries` would include it in the list of installable or installed plugins, leading to the execution of untrusted code.

resolveScopedChannelPluginId

src/commands/channel-setup/plugin-install.ts

The `resolveScopedChannelPluginId` function was vulnerable as it used `getChannelPluginCatalogEntry` to find the plugin associated with a channel. This could return a malicious plugin from the workspace if it shadowed a legitimate one. The returned plugin ID would then be used to install or load the plugin, resulting in arbitrary code execution.

setupChannels

src/flows/channel-setup.ts

The `setupChannels` function, specifically within its inner `preloadConfiguredExternalPlugins` function, was vulnerable. It iterated through all channel plugin catalog entries using `listChannelPluginCatalogEntries`, which included untrusted workspace plugins. If a configured channel was shadowed by a malicious workspace plugin, this function would proceed to load the malicious plugin, leading to code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.