vulnerability · openclaw
Plugin install wrappers could skip install policy
Plugin install wrappers could skip install policy. The official advisory identifies openclaw >= 2026.6.5, < 2026.6.9 as affected.
medium severityconfirmed confidencepatchedNo known exploitation
Quick answer
What defenders need to know
- What is it?
- Plugin install wrappers could skip install policy. The official advisory identifies openclaw >= 2026.6.5, < 2026.6.9 as affected.
- Who is affected?
- openclaw >= 2026.6.5, < 2026.6.9
- What should defenders do?
- Upgrade openclaw to 2026.6.9 or later.
- Is a fix available?
- Yes. Upgrade to 2026.6.9.
01 / Response
What to do
- Upgrade openclaw to 2026.6.9 or later.
- Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.
02 / Technical assessment
Evidence-backed analysis
OpenClaw's official security advisory assigns medium severity with CVSS 4.9 and references CWE-863.
- Official advisory: Plugin install wrappers could skip install policy.
- Affected range: >= 2026.6.5, < 2026.6.9. First patched version: 2026.6.9.
03 / Timeline
Disclosure timeline
- Advisory published
OpenClaw published GHSA-wgq8-x5wm-g4rw.
04 / Standards crosswalk
Standards crosswalk
FrameworkControl IDStatusEvidence
Control ID
LLM03risk alignmentStatusCandidate mapping
EvidenceNo supporting evidence published
Control ID
CWE-863weakness referenceStatusSupported
05 / Primary sources