Inclusion of Functionality from Untrusted Control Sphere in OpenClaw - #VU135906
Published: June 30, 2026
Vulnerability identifier: #VU135906
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute or persist actions beyond the caller's intended authorization.
The vulnerability exists due to inclusion of functionality from untrusted control sphere in setup-mode discovery workspace plugins when processing a configured input path or lower-trust caller-controlled workspace input. A remote attacker can provide a crafted workspace plugin path or plugin input to execute or persist actions beyond the caller's intended authorization.
Only instances where the affected feature is enabled and reachable are vulnerable, and user interaction is required.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.22