Description
OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.3.31 | 2026.3.31 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.3.31 | 2026.3.31 | GHSA-cwq8-6f96-g3q4 |
Advisories 1
- WID-SEC-2026-0948 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 28, 2026
References
- GitHub Security Advisory (GHSA-cwq8-6f96-g3q4) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation third-party-advisory