Openclaw CVE-2026-41330

Exploitation requires the following specific, concrete conditions: (1) The attacker must already be authenticated to the system as a user with limited privileges (PR:L in CVSS vector), meaning they have a valid local account or have already obtained initial access; (2) The attacker must have the ability to set or modify environment variables in the context where OpenClaw's host exec policy is executed-this is typical for local shell access but may be restricted in containerized or sandboxed deployments; (3) The host exec policy feature must be enabled and in active use (non-default configurations may have this disabled entirely); (4) The vulnerability is triggered only when OpenClaw spawns a subprocess or external command via its host exec policy (AT:P indicates process interaction is required, meaning the attacker must indirectly cause OpenClaw to execute a command or must have timing control). The vulnerability does NOT affect remote, unauthenticated attackers-it is strictly a local privilege boundary bypass for authenticated users trying to escalate control over subprocess security policies.

This vulnerability presents LOW real-world risk despite its security-control-bypass nature, based on multiple converging signals: CVSS 2.0 score reflects the severe attack vector restrictions (local-only, limited scope impact); the CVSS vector indicates attack via local access (AV:L), low attack complexity (AC:L), but requires prior authentication (PR:L) and process interaction (AT:P), all of which significantly reduce exploitation probability; EPSS score is not provided but the confluence of authentication requirement, local-access-only vector, and process interaction suggests genuine friction for attackers; no KEV status or active exploitation reported; no public exploit code identified. The vulnerability is real and should be patched, but it is NOT a remote code execution or immediate lateral movement risk. Defenders should prioritize this below network-accessible vulnerabilities and those with lower authentication barriers. The authentication requirement (PR:L) is the primary limiting factor-this requires an attacker already authenticated to the system, narrowing the threat model significantly.

An authenticated local user with limited privileges obtains shell access to a system running OpenClaw. The attacker sets environment variables such as NODE_TLS_REJECT_UNAUTHORIZED=0 or GIT_SSL_NO_VERIFY=1 before triggering an OpenClaw host exec policy execution. When OpenClaw launches an external command or subprocess, it inherits the malicious environment variables, causing the subprocess to skip TLS verification or proxy enforcement. The attacker can then perform a man-in-the-middle attack, redirect Docker operations, or clone a Git repository over an unencrypted connection from a malicious server.