Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42428 Malicious Plugin Installation via Integrity Verification Bypass in OpenClaw Before 2026.4.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42428
Post summary
The statement announces a new vulnerability in OpenClaw (CVE‑2026‑42428) with a brief description of the flaw, but provides no PoC, exploit, mitigation, or evidence of active exploitation.
CVE-2026-42428 OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages wi… https://www.cve.org/CVERecord?id=CVE-2026-42428
Post summary
OpenClaw versions earlier than 2026.4.8 have a flaw that bypasses integrity checks on plugin archives, enabling attackers to install tampered plugins.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |