Environment Variable Injection Vulnerability in OpenClaw by OpenClaw

CVE-2026-41294

What is CVE-2026-41294?

OpenClaw versions prior to 2026.3.28 are susceptible to an environment variable injection vulnerability due to improper loading of the current working directory (.env) file before applying the trusted state-directory configuration. This flaw permits attackers to introduce a malicious .env file within a repository or workspace, which can override vital runtime configurations and sensitive environmental settings during the initialization of OpenClaw. Such vulnerabilities can lead to unauthorized changes and exploitations that compromise application integrity.

References