OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.1%
exploitation probability
0.1%top 96% of all CVEs
observed exploitation
nono source reports it
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
OpenClaw · OpenClaw