Which versions of OpenClaw are affected by CVE-2026-41368?

CVE-2026-41368 is a credential disclosure vulnerability in OpenClaw jq safe-bin policy that allows authenticated users to extract sensitive environment variables and configuration data through filter…. A patch is available.

How to fix or mitigate CVE-2026-41368?

Within 24 hours: Audit all OpenClaw jq deployments to identify current versions and document which systems process untrusted jq programs with authenticated access. Within 7 days: Contact OpenClaw vendor to obtain and stage patched version 2026.3.28 in a test environment; validate compatibility with dependent applications. Within 30 days: Deploy patched version 2026.3.28 to all production and non-production environments running affected versions; verify remediation through jq filter execution testing.

OpenClaw CVE-2026-41368

Q: What is the CVSS score of CVE-2026-41368?

CVE-2026-41368 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-04-28 disclosure@vulncheck.com

Information Disclosure Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 00:31 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter. Attackers can bypass safe-bin restrictions by using $ENV in jq programs to access sensitive environment variables that should be restricted.

AnalysisAI

Environment variable disclosure in OpenClaw jq safe-bin policy allows authenticated remote attackers to extract sensitive credentials and configuration data. The vulnerability stems from incomplete filter blocking in jq program execution - specifically, the $ENV filter can bypass safe-bin restrictions to read process environment variables. Versions prior to 2026.3.28 are affected. No CISA KEV listing or public POC identified at time of analysis, but disclosure by VulnCheck indicates vendor-confirmed issue with available patch.

Technical ContextAI

OpenClaw implements a safe-bin security policy to restrict jq (a lightweight JSON processor) program execution capabilities. The vulnerability arises from CWE-668 (Exposure of Resource to Wrong Sphere) where the policy's filter allowlist/blocklist fails to account for jq's $ENV operator. In jq, $ENV provides access to the shell environment hash, enabling expressions like '$ENV.AWS_SECRET_ACCESS_KEY' to extract arbitrary environment variables. This breaks the security boundary intended by safe-bin mode, as environment variables commonly store API keys, database credentials, tokens, and internal configuration that should remain isolated from user-controllable jq programs. The flaw represents a classic sandbox escape via insufficient input validation of domain-specific language (DSL) features.

RemediationAI

Upgrade to OpenClaw version 2026.3.28 or later, which implements proper $ENV filter blocking in the jq safe-bin policy. Vendor patch available per GitHub security advisory GHSA-jccr-rrw2-vc8h at https://github.com/openclaw/openclaw/security/advisories/GHSA-jccr-rrw2-vc8h. For environments unable to upgrade immediately, implement compensating controls: (1) Remove sensitive credentials from environment variables and migrate to secure secret management systems (HashiCorp Vault, AWS Secrets Manager, Kubernetes Secrets) - this reduces exposure but requires application refactoring and may break existing integrations; (2) Restrict authenticated access to jq execution endpoints using network ACLs or authentication layer controls to trusted users only - reduces attack surface but does not eliminate risk from insider threats or compromised accounts; (3) Implement environment variable filtering at the process level to strip sensitive variables before OpenClaw process initialization - requires container/systemd configuration changes and careful testing to avoid breaking legitimate application functionality. All workarounds trade operational complexity for risk reduction; vendor patch is the definitive solution.