CVEvulnerability
CVE-2026-41369
7.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-28
- Last modified
- 2026-07-24
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-668
Description
OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.
Affected configurations
• openclaw openclaw (< 2026.3.31)
Related
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness
References
- https://github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975c Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cg7q-fg22-4g98 Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-host-execution Third Party Advisory