Which versions of OpenClaw are affected by CVE-2026-41294?

OpenClaw versions prior to 2026.3.28 contain an environment variable injection vulnerability that allows local attackers to override security-sensitive runtime configurations through malicious .env…. A patch is available.

How to fix or mitigate CVE-2026-41294?

Within 24 hours: Inventory all OpenClaw deployments and identify instances running versions before 2026.3.28; notify development teams to avoid opening untrusted repositories or unfamiliar workspace directories in OpenClaw. Within 7 days: Implement directory-level access controls and file monitoring on development workstations to alert on .env file creation in project directories; establish policy requiring code review before opening external repositories. Within 30 days: Monitor vendor advisories for OpenClaw 2026.3.28 or later patch release and schedule immediate deployment upon availability; consider alternative tools if patching timeline extends beyond 60 days.

OpenClaw CVE-2026-41294

Q: What is the CVSS score of CVE-2026-41294?

CVE-2026-41294 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

External Control of System or Configuration Setting (CWE-15)

2026-04-21 disclosure@vulncheck.com

GHSA-8rh7-6779-cjqq

Information Disclosure Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:38 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment settings during OpenClaw startup.

AnalysisAI

OpenClaw versions before 2026.3.28 allow local attackers to inject malicious environment variables by placing a .env file in the current working directory, which is loaded before trusted state-directory configuration during application startup. This enables attackers to override security-sensitive runtime settings without privileges, achieving high confidentiality, integrity, and availability impact with low complexity when a user launches OpenClaw from a compromised directory. Exploitation probability is minimal (EPSS 0.01%, percentile 2%) with no active exploitation confirmed (not in CISA KEV), but a public advisory from VulnCheck describes the attack mechanism, making exploitation straightforward for local threat actors.

Technical ContextAI

This vulnerability stems from improper handling of .env configuration file precedence (CWE-15: External Control of System or Configuration Setting). OpenClaw loads environment variables from a .env file in the current working directory before processing its trusted state-directory configuration. Environment variable injection attacks exploit application trust in externally-controlled configuration sources. In this case, the application's search path prioritizes user-controlled directories over secure system directories, violating the principle of secure defaults. When users clone malicious repositories or navigate to attacker-controlled directories before launching OpenClaw, the untrusted .env file is processed during initialization, allowing arbitrary environment variable manipulation. This pattern commonly affects containerized applications, development tools, and CLI utilities that use .env files for configuration management, and represents a broader class of supply chain and workspace-based attacks.

RemediationAI

Upgrade to OpenClaw version 2026.3.28 or later, which addresses the configuration file precedence issue by loading trusted state-directory settings before processing current working directory .env files. The patch is available from the official OpenClaw GitHub repository per security advisory GHSA-8rh7-6779-cjqq. Until patching is complete, implement these compensating controls with their trade-offs: (1) Launch OpenClaw only from trusted directories outside user-controlled workspaces-reduces productivity for developers who need to work in project directories; (2) Configure file system monitoring to alert on .env file creation in common working directories-generates operational overhead and may produce false positives; (3) Use read-only mounting for untrusted repositories when reviewing third-party code-prevents normal development workflows requiring file modification; (4) Implement mandatory code review for .env files in all cloned repositories before launching OpenClaw-adds manual review burden to development process. Organizations should also educate users about workspace-based attacks and establish secure directory policies for running development tools. Review and audit existing .env files in OpenClaw working directories for unauthorized modifications.