OpenClaw CVE-2026-41294

Exploitation requires the victim to launch OpenClaw from a directory containing an attacker-placed .env file. Specific prerequisite: user must execute OpenClaw with current working directory set to an attacker-controlled path, typically by cloning a malicious repository, extracting a malicious archive, or navigating to a compromised shared directory before launching the application. The CVSS vector confirms no privileges required (PR:N) but mandatory user interaction (UI:P)-the victim must actively start OpenClaw in the compromised location. Limiting factors that reduce realistic risk: (1) Local attack vector (AV:L) requires prior access to user's filesystem or successful social engineering to deliver malicious files; (2) User interaction requirement (UI:P) means automated exploitation is not possible; (3) Attack targets development/workspace scenarios rather than default system installations; (4) Scope unchanged (SC:N) indicates impact limited to OpenClaw process context, not spreading to other system components without additional exploitation. Organizations where users do not launch OpenClaw from untrusted directories face minimal risk despite the high CVSS score.

CVSS 8.5 (High) reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:P). However, real-world exploitation risk is constrained by multiple factors. EPSS score of 0.01% (percentile 2%) indicates extremely low observed exploitation probability, consistent with SSVC assessment showing no current exploitation and non-automatable attack. Attack requires social engineering to trick users into launching OpenClaw from attacker-controlled directories-not a default scenario. The local attack vector (AV:L) significantly reduces exposure compared to network-exploitable vulnerabilities. CISA SSVC total technical impact rating acknowledges potential for complete system compromise if exploited, but the combination of user interaction requirement, local vector, and 2nd-percentile EPSS score positions this as a supply chain hygiene issue rather than an imminent mass-exploitation threat. Primary risk scenarios involve targeted attacks against developers using OpenClaw in untrusted repositories or social engineering campaigns distributing malicious project files. The high CVSS score reflects worst-case impact, not likelihood-this is a medium-priority issue for organizations using OpenClaw, requiring awareness and process changes rather than emergency patching.

An attacker distributes a malicious Git repository containing a crafted .env file that overrides OpenClaw's security settings, such as disabling authentication checks, redirecting logging to attacker-controlled servers, or injecting malicious paths into library search variables. When a developer clones the repository and launches OpenClaw from that directory to analyze or build the project, OpenClaw loads the malicious .env file before its trusted configuration, applying the attacker's environment variables. The attacker gains control over OpenClaw's runtime behavior, potentially exfiltrating sensitive data, executing arbitrary code through manipulated library paths, or bypassing security controls-all without requiring elevated privileges or exploiting code vulnerabilities. Public advisory from VulnCheck describes this attack mechanism, reducing research burden for potential attackers.