Environment Variable Filtering Vulnerability in OpenClaw by OpenClaw

CVE-2026-62203

What is CVE-2026-62203?

OpenClaw, in versions before 2026.6.6, exhibits an environment variable filtering vulnerability in its host exec function. This flaw arises from inadequate sanitization of startup variables linked to rustup, allowing attackers with lower-trust access to execute unauthorized actions or to maintain persistence beyond their designated permissions. This vulnerability poses significant risks for systems relying on OpenClaw, potentially granting elevated access to malicious actors.

References