OpenClaw CVE-2026-41369

Requires authenticated access with low-privilege credentials (PR:L) to OpenClaw instances. Exploitation specifically requires that the attacker can influence or inject environment variables processed during OpenClaw host exec operations - typically when submitting jobs, build requests, or deployment tasks that trigger external command execution. The vulnerability is exploitable against default configurations where environment variable sanitization is absent (versions pre-2026.3.31). Attack is limited by the need for valid user credentials and access to functionality that invokes host exec operations; purely API-based interactions without exec triggers are not vulnerable. Network accessibility (AV:N) means remote authenticated users can exploit without local system access.

Real-world risk is MODERATE-HIGH despite the 7.1 CVSS score. The CVSS:4.0 vector shows favorable attacker conditions: network-accessible (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), and no user interaction (UI:N), with high confidentiality impact (VC:H). However, the PR:L (low privileges required) constraint significantly reduces the attack surface compared to unauthenticated scenarios. The Docker and registry override capabilities present supply chain attack vectors - attackers could inject malicious dependencies during build/deployment operations, potentially achieving code execution beyond the stated confidentiality impact. The 'Information Disclosure' tag suggests credential/secret exposure risk when TLS validation is bypassed. Key unknowns: EPSS probability data missing; no CISA KEV listing indicates no confirmed widespread exploitation; exploit code status unclear from available references. Prioritization depends heavily on whether OpenClaw instances are exposed to untrusted authenticated users and whether host exec operations process user-influenced environment contexts. Organizations using OpenClaw in CI/CD pipelines or multi-tenant environments face elevated risk due to potential lateral movement via compromised build environments.

An authenticated attacker with low-privilege access to OpenClaw submits a request triggering host exec operations while injecting environment variables such as DOCKER_REGISTRY=attacker.com:5000 and NODE_TLS_REJECT_UNAUTHORIZED=0. OpenClaw's unsanitized exec handler uses these variables during a container pull or package install operation, redirecting requests to the attacker-controlled registry without TLS validation. The attacker's registry responds with credential challenges, capturing authentication tokens, or serves malicious packages/images that execute on the host system, potentially escalating beyond the initial confidentiality impact to achieve code execution or lateral movement in the infrastructure.