CVE-2026-41369
MEDIUM severity · CVSS 6.5 · CWE-668
6.5CVSS MEDIUM
Summary
OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975c ↗
Additional information
- NVD record
- https://github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975cPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cg7q-fg22-4g98Advisory
- https://www.vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-host-executionAdvisory