EUVD-2026-25341
GHSA-w5qr-q983-45ww
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low privileges required; AC:H because exploitation depends on non-default SSH environment forwarding configuration being active; confidentiality-only limited impact, no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.
AnalysisAI
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js process.env object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.
Technical ContextAI
OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a Node.js-based tool distributed via npm that provides SSH-based sandbox backends for executing isolated workloads. The root cause is CWE-214 (Invocation of Process Using Visible Sensitive Information): when spawning SSH child processes, the application passes Node.js's process.env - the runtime's full inherited environment variable map - without first filtering or sanitizing it. In Node.js, process.env can contain deployment secrets injected at runtime (e.g., via CI/CD pipelines or container orchestrators), including API tokens, database credentials, and private keys. The SSH protocol supports environment variable forwarding through SendEnv (client) and AcceptEnv (server) directives; when these are configured to forward broadly, the SSH child process receives and can expose variables from the parent's environment that should never have crossed the process boundary.
RemediationAI
Upgrade the openclaw npm package to version 2026.3.31 or later, which is the first stable release containing the fix introduced in commit cfe14459531e002a1c61c27d97ec7dc8aecddc1f (merged 2026-03-30). The vendor advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-j9pv-rrcj-6pfx and the patch commit is at https://github.com/openclaw/openclaw/commit/cfe14459531e002a1c61c27d97ec7dc8aecddc1f. Where an immediate upgrade is not feasible, the most targeted compensating control is to restrict or disable SSH environment variable forwarding on the host's SSH daemon by setting AcceptEnv to an empty or tightly scoped list in sshd_config and reloading sshd; this eliminates the non-default forwarding configuration that enables the cross-process leakage. Note that restricting AcceptEnv may break any legitimate applications on the same host that depend on SSH-forwarded environment variables (e.g., locale or custom toolchain variables), so operators should audit existing AcceptEnv usage before applying this change.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today