CVE-2026-41295

CVE-2026-41295 is an improper trust boundary vulnerability affecting OpenClaw versions prior to 2026.4.2. The flaw allows malicious workspace channel shadows to execute code during built-in channel setup and login operations. An attacker can exploit this by cloning a workspace with a specially crafted plugin that claims a bundled channel ID, achieving unintended in-process code execution before the plugin receives explicit user trust. The vulnerability carries a HIGH severity rating with a CVSS score of 7.8. It requires local access (AV:L) with low attack complexity and no special privileges, but does require user interaction. The impact is severe across all three security dimensions: confidentiality, integrity, and availability are all rated as high, meaning successful exploitation could result in complete system compromise. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. The EPSS score of 0.00013 indicates this vulnerability ranks lower than 99.98 percent of all CVEs in terms of exploitation probability. However, organizations should still prioritize patching to version 2026.4.2 or later given the high potential impact if exploited.