CVE-2026-42428

脆弱性の種類

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

影響を受ける製品

• openclaw openclaw

参考情報

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp
• https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads