OpenClaw Authentication Bypass (CVE-2026-43569) Poses High Risk

The National Vulnerability Database has disclosed CVE-2026-43569, an authentication bypass vulnerability in OpenClaw before version 2026.4.9. This flaw allows untrusted workspace plugins to be automatically enabled during non-interactive onboarding if provider authentication choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are then automatically selected and enabled during authentication setup, bypassing explicit user consent.

This is a high-severity vulnerability, rated 8.8 on the CVSS scale (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The core issue, categorized as CWE-829 (Improper Neutralization of Script in an Untrusted Input), lies in how OpenClaw handles plugin activation during initial setup. The attacker’s calculus here is straightforward: leverage a trusted initial setup process to inject and activate malicious code without user interaction, gaining a foothold or further access.

For defenders, this means a critical review of onboarding processes and plugin management is necessary. The risk is amplified in environments relying heavily on automated deployments or where users might rush through initial setup. This isn’t about a user making a bad click; it’s about a system implicitly trusting a malicious component during a critical phase.