A vulnerability in OpenClaw allows for the execution of untrusted plugins, which could result in a complete compromise of the affected host system.

This issue is identified as CWE-829, involving the inclusion of functionality from an untrusted control sphere. The application fails to properly validate plugins when operating in setup mode, allowing an attacker to force the execution of malicious code.

Exploitation of this vulnerability grants an attacker the ability to execute code with the privileges of the user running OpenClaw. The CVSS score of 7.8 underscores the severity of this risk, as it can lead to unauthorized data access, system manipulation, and potential lateral movement within the network. Organizations must treat this as a high-priority update to ensure the security of their development and production environments.

Immediate Action: Update OpenClaw to version 2026.5.22 or later to ensure that plugin loading is restricted to trusted sources.

Proactive Monitoring: Review application logs for unauthorized plugin registration or unexpected changes to the configuration files governing setup mode.

Compensating Controls: Disable setup mode when not actively required and ensure that the application is executed with the principle of least privilege to minimize potential damage.

Public Exploit Available: No (exploit_available: unknown)

Administrators should prioritize upgrading to version 2026.5.22 to eliminate this vulnerability. By ensuring that only verified plugins can be loaded, organizations can significantly reduce the risk of arbitrary code execution and maintain the integrity of their deployments.