CVE-2026-42428
OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 28, 2026
- Updated
- Apr 29, 2026
- Reserved
- Apr 27, 2026
Description
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.5 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-353 Missing Support for Integrity Check
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-3vvq-q2qc-7rmp)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloadsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.