Which versions of OpenClaw are affected by CVE-2026-41369?

OpenClaw versions prior to 2026.3.31 contain an environment variable injection vulnerability that allows authenticated users to manipulate package managers, Docker registries, and compiler…. A patch is available.

How to fix or mitigate CVE-2026-41369?

Within 24 hours: Identify all OpenClaw deployments and document current versions in use; assess whether low-privilege user accounts have host exec permissions. Within 7 days: Contact OpenClaw maintainers to obtain patched version 2026.3.31 or later, or apply the fix from GitHub commit eb8de67 if self-building; test in non-production environment. Within 30 days: Deploy patched OpenClaw version across all production systems; restrict host exec permissions to high-privilege accounts only as interim control.

OpenClaw CVE-2026-41369

Q: What is the CVSS score of CVE-2026-41369?

CVE-2026-41369 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-04-28 disclosure@vulncheck.com

Docker Information Disclosure

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 00:31 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.

AnalysisAI

Environment variable injection in OpenClaw (pre-2026.3.31) allows authenticated remote attackers to compromise host execution integrity by injecting malicious variables that override package managers, Docker registries, compiler paths, and TLS configurations during host exec operations. The vulnerability exhibits high confidentiality impact (CVSS:4.0 VC:H) with network attack vector and low complexity (AV:N/AC:L), requiring only low-privilege authentication (PR:L). VulnCheck disclosure indicates this affects Docker-related operations, with fixes available via GitHub commit eb8de67 and tracked under GHSA-cg7q-fg22-4g98. EPSS and KEV data not available at time of analysis.

Technical ContextAI

OpenClaw's host execution component (CWE-668: Exposure of Resource to Wrong Sphere) fails to properly sanitize environment variables before executing commands on the host system. The vulnerability specifically targets variables controlling critical system dependencies: package manager configuration (NPM_CONFIG_*, PIP_*, etc.), container registry endpoints (DOCKER_REGISTRY, REGISTRY_AUTH), compiler toolchain paths (CC, CXX, PATH), and TLS/SSL certificate validation settings (SSL_CERT_FILE, REQUESTS_CA_BUNDLE, NODE_TLS_REJECT_UNAUTHORIZED). When OpenClaw performs host exec operations, it inherits or processes user-controlled environment variables without adequate filtering, allowing attackers to redirect dependency resolution to malicious sources, disable certificate validation, or execute attacker-controlled binaries. This is particularly critical in containerized environments where Docker and registry configurations can be hijacked to pull malicious images or leak credentials.

RemediationAI

Upgrade to OpenClaw version 2026.3.31 or later, which implements proper environment variable sanitization for host exec operations per commit eb8de6715f02949c21c4e895fffc8a6dcb00975c available at https://github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975c. The patch adds filtering for package manager variables (NPM_CONFIG_*, PIP_INDEX_URL, etc.), registry configurations (DOCKER_REGISTRY, REGISTRY_AUTH_FILE), compiler paths (CC, CXX, LD_LIBRARY_PATH), and TLS override variables (SSL_CERT_FILE, NODE_TLS_REJECT_UNAUTHORIZED, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE). If immediate patching is not feasible, implement these compensating controls: (1) Restrict OpenClaw host exec operations to trusted administrative users only - remove PR:L access for untrusted accounts, trading reduced functionality for attack surface reduction; (2) Run OpenClaw processes in isolated containers with read-only root filesystems and explicit environment variable allowlists via seccomp/AppArmor profiles, which adds operational complexity but prevents variable injection at the container runtime level; (3) Monitor and alert on unexpected environment variable patterns in OpenClaw logs, particularly TLS_REJECT_UNAUTHORIZED=0 or non-standard registry URLs, though this provides detection rather than prevention. Consult VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-host-execution for additional context.