CVE-2026-42428

HIGH

OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

Title source: cna
STIX 2.1

Description

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-3vvq-q2qc-7rmp)
https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads
https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads

Scores

CVSS v3 7.1
EPSS 0.0002
EPSS Percentile 4.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-353
Status published
Products (2)
OpenClaw/OpenClaw < 2026.4.8
OpenClaw/OpenClaw 2026.4.8
Published Apr 28, 2026
Tracked Since Apr 29, 2026