Environment Variable Bypass in OpenClaw by OpenClaw

CVE-2026-41391

What is CVE-2026-41391?

The vulnerability in OpenClaw allows for inadequate sanitization of PIP_INDEX_URL and UV_INDEX_URL environment variables, creating an opportunity for attackers to redirect Python package-index traffic. By exploiting this flaw, attackers might intercept or manipulate package management operations through the injection of malicious index URLs, thereby compromising the security of package handling within the affected environments.

References