Environment Variable Namespace Collision in OpenClaw by OpenClaw

CVE-2026-44114

What is CVE-2026-44114?

The OpenClaw vulnerability allows an attacker to manipulate runtime behavior by exploiting the failure to properly reserve the runtime-control environment namespace in workspace dotenv files. Malicious actors can set critical variables like OPENCLAW_GIT_DIR in untrusted workspaces, potentially leading to unauthorized configurations and harmful changes during source-update or installation processes.

References