Environment Variable Injection in OpenClaw CLI Backend Runner
CVE-2026-41384

8.5HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
28 April 2026

What is CVE-2026-41384?

OpenClaw, prior to version 2026.3.24, contains a vulnerability that allows attackers to exploit the CLI backend runner through malicious environment variable injection. By manipulating workspace configurations, attackers can inject arbitrary environment variables, which may lead to unauthorized code execution or exposure of sensitive data. This vulnerability raises serious security concerns for users by potentially compromising the integrity of backend processes.

Affected Version(s)

OpenClaw 0 < 2026.3.24

OpenClaw 2026.3.24

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/c2fb7f1948c32...
patch
https://www.vulncheck.com/advisories/openclaw-environment...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edward-x (@YLChen-007)
.