Vulnerability details
CVE-2026-41384
OpenClaw OpenClaw
OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend
CVSS 4.0
8.5High
Official description
OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables into the backend process spawning, enabling code execution or sensitive data exposure.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| OpenClaw | OpenClaw | v < 2026.3.24 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/openclaw/openclaw/security/advisories/GHSA-vfw7-6rhc-6xxg vendor-advisory
- https://github.com/openclaw/openclaw/commit/c2fb7f1948c3226732a630256b5179a60664ec24 patch
- https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-workspace-config-in-cli-backend third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-28
- Last updated
- 2026-04-29
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.14%
Probability of exploitation in 30 days
3.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-15External Control of System or Configuration Setting