https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T09:35:20.838018+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-43571 CVE-2026-43571 — OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup 2026-09-29T09:35:20.841508+00:00

Affected: OpenClaw

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

 https://db.gcve.eu/vuln/ghsa-82qx-6vj7-p8m2 GHSA-82qx-6vj7-p8m2 — OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows 2026-09-29T09:35:20.841699+00:00

Affected: npm: openclaw

## Summary

Channel setup catalog lookups could include untrusted workspace plugin shadows.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Channel setup could resolve a workspace plugin shadow before a bundled channel plugin, causing setup-time plugin loading without the intended trust gate.

## Technical Details

The fix routes setup catalog lookups through trusted catalog paths and uses `excludeWorkspace: true` where setup should not include workspace shadows.

## Fix

The issue was fixed in the advisory fix branch. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `1fede43b948df40ca8674511d4bd08d39f6c5837` - PR: private advisory fork

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.