CVE-2026-41295: OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

April 7, 2026 (updated April 20, 2026)

Before OpenClaw 2026.4.2, built-in channel setup and login could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin that claimed a bundled channel id could execute during channel setup even while still disabled.

References

github.com/advisories/GHSA-2qrv-rc5x-2g2h
github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0
github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h
nvd.nist.gov/vuln/detail/CVE-2026-41295

Code Behaviors & Features

Detect and mitigate CVE-2026-41295 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →