OpenClaw CVE-2026-41368

Requires authenticated access with low privilege level (PR:L per CVSS vector) to OpenClaw instances that execute user-supplied jq programs under safe-bin policy restrictions. The vulnerable code path is triggered when jq programs containing $ENV filter expressions are submitted for execution. No special configuration or non-default settings required - default safe-bin policy in affected versions is inherently vulnerable. Exploitation is limited to environments where OpenClaw actually uses jq safe-bin mode; deployments that disable jq execution entirely or use alternative JSON processing are not exposed via this vector. Network reachability (AV:N) means remote exploitation is possible for any authenticated user, including those accessing via web interfaces or API endpoints. No user interaction required (UI:N) once authentication is obtained.

CVSS 4.0 score of 7.1 reflects high confidentiality impact (VC:H) with network attack vector and low complexity (AV:N/AC:L/AT:N), mitigated by low privilege requirement (PR:L). Real-world risk depends heavily on deployment context: environments storing sensitive credentials in environment variables face immediate exposure risk. The attack requires authenticated access, reducing exposure surface compared to unauthenticated vulnerabilities, but network reachability (AV:N) means any authenticated user across network boundaries can exploit this. No EPSS data available for this 2026 CVE. Absence from CISA KEV suggests no confirmed widespread exploitation, but VulnCheck disclosure indicates professional security researcher identification - these often precede attacker discovery. The low attack complexity (AC:L) means exploitation requires minimal skill once the bypass technique is known. Primary risk is credential theft leading to lateral movement or privilege escalation in broader infrastructure. Organizations using OpenClaw with environment-based secrets management should treat as high priority; those without sensitive environment variables face lower confidentiality risk but should still patch to maintain defense in depth.

An authenticated attacker with low-privilege network access to OpenClaw submits a malicious jq program containing '$ENV.DATABASE_PASSWORD' or '$ENV.AWS_SECRET_ACCESS_KEY' expressions. The safe-bin policy, intended to block such access, fails to filter the $ENV operator. OpenClaw executes the jq program, which extracts the requested environment variables and returns them in the JSON output to the attacker. The attacker now possesses credentials for backend databases, cloud provider APIs, or internal services, enabling lateral movement to compromise additional systems beyond the initial OpenClaw instance.