Environment Variable Injection in OpenClaw Product by OpenClaw

CVE-2026-43531

What is CVE-2026-43531?

OpenClaw versions prior to 2026.4.9 are susceptible to an environment variable injection vulnerability. This security flaw allows attackers to manipulate runtime-control variables through malicious .env files placed in workspace directories. By crafting these files, an attacker could alter key application behaviors, such as update sources, gateway URLs, ClawHub resolution, and even executable paths for browsers, potentially leading to significant security breaches. It is crucial for users to upgrade to the latest version to mitigate these risks.

References