OpenClaw CVE-2026-100570

Exploitation requires (1) an untrusted, attacker-controlled OpenClaw workspace containing a malicious .env file that sets the CLOUDSDK_PYTHON_ARGS environment variable; (2) an operator who starts OpenClaw against that workspace content; and (3) that operator subsequently running the Gmail setup flow, which invokes the gcloud launcher and passes the inherited variable to the trusted Python interpreter. Limiting factors: the attack is local (payload must already reside in the workspace), and it depends entirely on operator action in a specific setup flow - it cannot be triggered remotely or unattended. The documented workaround (run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand) directly neutralizes the condition. Affected versions are 2026.3.28 through 2026.8.0; 2026.8.1 fixes it.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5 High, and this aligns with the mechanics: the flaw is fundamentally local - it requires the attacker's payload to already be present in the OpenClaw workspace as a malicious .env file, and it requires an operator to both launch OpenClaw against that attacker-controlled content and then actively run the Gmail setup flow (the UI:P/passive-interaction and my UI:R condition). Impact is genuinely severe once triggered: CWE-88 argument injection into the trusted Python interpreter yields full code execution as the host user (VC:H/VI:H/VA:H - credential theft, file modification, arbitrary process spawning). There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so this is a credible-but-unproven risk rather than an actively exploited one. The 'PR:N' rating is technically defensible (the attacker plants a file rather than authenticating) but is misleading in isolation - real exploitation is gated behind local workspace control plus operator action, which substantially lowers real-world likelihood. Note the input Tag 'Information Disclosure' understates and mislabels the issue: this is remote-code-execution/argument-injection, not mere disclosure. Net: a real defect worth patching, but a targeted/social-engineering-dependent one, not a mass-exploitable network vulnerability.

An attacker publishes or contributes a repository/workspace containing a crafted .env file that sets CLOUDSDK_PYTHON_ARGS to a malicious value. An operator clones this workspace, starts OpenClaw inside it, and runs the Gmail setup flow; the poisoned variable is inherited when gcloud launches Python, and the injected arguments cause Python to execute the attacker's code with the operator's host permissions. No public exploit code was identified at time of analysis.