Workspace Dotenv File Vulnerability in OpenClaw for Matrix, Mattermost, IRC, and Synology
CVE-2026-45003

4.1MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
11 May 2026

What is CVE-2026-45003?

The OpenClaw platform prior to version 2026.4.22 contains a flaw that allows workspace dotenv files to override connector endpoint hosts. This vulnerability enables attackers with access to a workspace to alter traffic by manipulating endpoint variables defined in dotenv files, potentially redirecting runtime requests to malicious endpoints. The issue affects connectors for popular services like Matrix, Mattermost, IRC, and Synology, posing significant risks to data integrity and application security.

Affected Version(s)

OpenClaw 0 < 2026.4.22

OpenClaw 2026.4.22

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/0623079e98abf...
patch
https://www.vulncheck.com/advisories/openclaw-connector-e...
third-party-advisory

CVSS V4

Score:
4.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qi Deng (@qi-scape)
.