GHSA-2qrv-rc5x-2g2h: OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

April 7, 2026

Before OpenClaw 2026.4.2, built-in channel setup and login could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin that claimed a bundled channel id could execute during channel setup even while still disabled.

References

github.com/advisories/GHSA-2qrv-rc5x-2g2h
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0
github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h

Code Behaviors & Features

Detect and mitigate GHSA-2qrv-rc5x-2g2h with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →