EUVD-2026-12720
GHSA-8fmp-37rc-p5g7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Impact | The CVSS 3.1 score of 6.1 (Medium severity) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L reflects that this requires local access and low privilege level to trigger, but results in high integrity impact (arbitrary code execution) and low availability impact. The attack complexity is low (no special conditions required), and no user interaction is needed. However, the availability of a vendor patch and active documentation from security research firm VulnCheck suggest this is a known, addressable risk rather than a zero-day. The local attack vector constraint significantly limits real-world impact in typical cloud and containerized deployments where attackers would first need to gain local system access; however, in shared hosting, on-premises, or developer machine scenarios, this becomes a critical concern. The fact that the integrity impact is rated as high (code execution) and that the patch is readily available elevates this to a priority remediation item despite the medium CVSS score. No evidence of active KEV listing or widespread exploit is indicated in the provided intelligence. |
| Exploit ScenarioDerived | A developer or operator with local access to an OpenClaw configuration file injects the environment variable NODE_OPTIONS='--require /tmp/malicious.js' into the env.vars configuration section. When the OpenClaw gateway service restarts (either manually or as part of an automated deployment), the injected variable is passed to the Node.js runtime without filtering, causing the gateway process to load and execute the attacker-controlled JavaScript module before the legitimate application code runs. This grants the attacker code execution with the full privileges of the OpenClaw service account, allowing data exfiltration, lateral movement, or service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
OpenClaw versions prior to 2026.2.21 contain an environment variable injection vulnerability that allows authenticated local attackers to execute arbitrary code at startup time by injecting dangerous process-control variables (such as NODE_OPTIONS or LD_*) through the configuration env.vars mechanism. An attacker with local privileges can manipulate the gateway service's runtime environment to achieve code execution in the service context, potentially compromising the entire OpenClaw deployment. A patch is available from the vendor, and this vulnerability has been documented by VulnCheck with supporting references to the GitHub security advisory and corresponding commit fix.
RemediationAI
Immediately upgrade OpenClaw to version 2026.2.21 or later, which includes the environment variable filtering patch (commit 2cdbadee1f8fcaa93302d7debbfc529e19868ea4). Until patching can be completed, restrict local system access to the OpenClaw configuration files and service runtime environment, implement least-privilege user accounts for the gateway service, and conduct a configuration audit to ensure no suspicious environment variable entries have been injected into existing configurations. Review all configuration sources (files, container environment, Kubernetes ConfigMaps, etc.) for unauthorized additions of process-control variables. For deployments that cannot be immediately patched, consider running OpenClaw in a restricted container environment with read-only filesystems and limited environment variable inheritance to reduce the blast radius of exploitation. Consult the vendor advisory at https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-config-env-vars for additional context and validation steps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is an application gateway service (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that processes configuration files containing environment variables. The vulnerability stems from a failure to implement proper input validation and filtering on environment variable names during the configuration parsing stage, which falls under CWE-15 (External Control of System or Configuration Setting). Process-control environment variables like NODE_OPTIONS (which can be used to load arbitrary Node.js modules), LD_PRELOAD, LD_LIBRARY_PATH, and similar variables allow attackers to influence how the application runtime initializes and loads code. Because these variables are evaluated at startup time before the application's main logic executes, sanitization must occur at configuration load time, not at runtime. The root cause is insufficient allowlisting or blacklisting of environment variable names when constructing the service's execution context.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.
Executive ViewAI
CVE-2026-22177 presents moderate security risk rated CVSS 6.1. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in OpenClaw Multiple Security Vulnerabilities
View all 4Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB