OpenClaw CVE-2026-100569

Requires that the operator launch OpenClaw (>=2026.4.25, <2026.8.1) inside attacker-controlled workspace content containing a crafted .env file, AND that Azure Speech is configured with a key and region but WITHOUT a trusted endpoint override set. The specific trigger is the workspace env-var filter failing to block variables ending in _ENDPOINT, letting the untrusted .env set AZURE_SPEECH_ENDPOINT, which Azure Speech prefers over the configured region. A voice-synthesis or voice-list request must then be issued to send the key to the attacker endpoint. Limiting factors: local attack vector (attacker must control workspace files), required operator interaction (starting the tool on hostile content and invoking a speech request), and the non-exploitability of deployments that pin a trusted endpoint override or do not use Azure Speech.

This is a credential-exposure flaw (CWE-522) in the open-source OpenClaw agent framework. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) scores 6.8 (medium), and its emphasis on a LOCAL attack vector with required user interaction is honest: exploitation depends on an operator actually launching OpenClaw against attacker-controlled workspace content while Azure Speech is configured with a key+region and no trusted endpoint override. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so all real-risk signals point to low likelihood of opportunistic exploitation. Impact is bounded to confidentiality of a single third-party credential (the Azure Speech key) with no integrity or availability effect (VI:N/VA:N) and no scope change to OpenClaw itself - the abused resource is the operator's separate Azure Speech account. Net: a legitimate supply-chain/workspace-trust issue worth patching, but a niche, precondition-heavy, medium-severity credential leak rather than an urgent priority. Note the vector states PR:N (unauthenticated) yet the practical prerequisite is that a trusting operator run the tool on hostile content - the 'authentication' gate is operator behavior, not an OpenClaw login.

An attacker seeds a repository or workspace with a malicious .env file containing AZURE_SPEECH_ENDPOINT pointing at an attacker-controlled host. An operator who has Azure Speech configured with a key and region (but no explicit trusted endpoint override) starts OpenClaw in that workspace; the next voice-synthesis or voice-list request sends the operator's Azure Speech key in the header to the attacker's endpoint, which the attacker then replays against the operator's real Azure Speech resource. No public exploit code is identified at time of analysis.