N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2qrv-rc5x-2g2h

GHSA-2qrv-rc5x-2g2h: OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

Summary

Before OpenClaw 2026.4.2, built-in channel setup and login could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin that claimed a bundled channel id could execute during channel setup even while still disabled.

Impact

A cloned workspace could turn channel setup for a built-in channel into unintended in-process code execution from an untrusted workspace plugin. This bypassed the intended workspace-plugin trust boundary during setup and login.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0 — ignore untrusted workspace channel shadows during setup resolution

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @zpbrent for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2qrv-rc5x-2g2h

GHSA-2qrv-rc5x-2g2h:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the channel plugin resolution process during channel setup. An untrusted workspace plugin could shadow a built-in channel, leading to code execution. The analysis of the patch commit 53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0 reveals the core of the vulnerability and the fix.

The primary vulnerable function is resolveInstallableChannelPlugin in src/commands/channel-setup/channel-plugin-resolution.ts. Before the patch, this function would resolve the first plugin that matched the requested channel ID, without considering the plugin's origin (e.g., bundled vs. workspace). This allowed a malicious plugin in an untrusted workspace to be selected over the legitimate, bundled plugin.

The fix introduces a new function, resolveTrustedCatalogEntry, which is now called by resolveInstallableChannelPlugin. This new function checks if a plugin originates from a workspace and, if so, verifies that it is explicitly trusted in the application's configuration. If the workspace plugin is not trusted, it is ignored, and the resolution process continues, looking for a safe, bundled alternative. This is accomplished by modifying listChannelPluginCatalogEntries in src/channels/plugins/catalog.ts to allow excluding workspace plugins from the search.

Therefore, an attacker could exploit this by crafting a malicious workspace with a plugin that has the same ID as a built-in channel. When a user in that workspace tries to set up that channel, the vulnerable version of OpenClaw would execute the malicious plugin's code.

Vulnerable functions

resolveInstallableChannelPlugin

src/commands/channel-setup/channel-plugin-resolution.ts

The `resolveInstallableChannelPlugin` function was vulnerable because it would resolve and potentially install a channel plugin from a workspace without verifying if the plugin was trusted. An attacker could create a malicious workspace plugin that impersonates a built-in channel. When a user initiated the setup for the built-in channel, this function would resolve the malicious plugin from the untrusted workspace, leading to arbitrary code execution. The patch introduces the `resolveTrustedCatalogEntry` function, which ensures that any plugin originating from the workspace is explicitly trusted in the configuration before it can be resolved for setup.

listChannelPluginCatalogEntries

src/channels/plugins/catalog.ts

This function is part of the vulnerable flow. It is responsible for listing available channel plugins. Before the patch, it would include plugins from the workspace without any trust verification. The vulnerable `resolveInstallableChannelPlugin` function would then use this list to select a plugin. The patch added the `excludeWorkspace` option to allow callers to filter out untrusted workspace plugins, which is used by the fixed `resolveInstallableChannelPlugin` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.