Is there a patch available for CVE-2026-41330?

Yes, a patch is available for CVE-2026-41330. Update the affected software to the latest version immediately.

Docker CVE-2026-41330

Q: What is the CVSS score of CVE-2026-41330?

CVE-2026-41330 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Insecure Default Variable Initialization (CWE-453)

2026-04-21 disclosure@vulncheck.com

Authentication Bypass Docker

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:40 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

LOW 2.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

AnalysisAI

OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.

Technical ContextAI

OpenClaw's host exec policy is designed to enforce security controls over external command execution, including proxy configuration, Transport Layer Security (TLS) verification for HTTPS connections, Docker container restrictions, and Git repository TLS enforcement. The vulnerability stems from CWE-453 (Insecure Resource Validation), where environment variables passed to executed processes are not properly validated or sanitized. This allows attackers to override critical security-related environment variables such as HTTP_PROXY, HTTPS_PROXY, NO_PROXY, NODE_TLS_REJECT_UNAUTHORIZED, DOCKER_HOST, and GIT_SSL_NO_VERIFY. The vulnerability affects OpenClaw versions prior to 2026.3.31, as identified by CPE references to the product.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later, which includes fixes to properly sanitize and validate environment variables in the host exec policy. This patch ensures that proxy, TLS, Docker, and Git TLS controls cannot be bypassed via environment variable injection. If immediate upgrading is not feasible, restrict local access to OpenClaw to trusted users only and implement file system monitoring on configuration and process-related directories to detect unauthorized environment variable modifications. Additionally, apply strict access controls on accounts with OpenClaw privileges (PR:L users) and consider disabling or restricting the host exec policy feature if not required for operational use. Refer to the GitHub security advisory (GHSA-9gp8-hjxr-6f34) and VulnCheck advisory for detailed patch notes and deployment guidance.