EUVD-2026-26082
GHSA-g8xp-qx39-9jq9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via environment overrides. Attackers with approved host-exec requests can override compiler binaries to execute arbitrary code during build processes.
AnalysisAI
OpenClaw before 2026.3.31 allows authenticated users with approved host-exec requests to execute arbitrary code during build processes by overriding compiler binary environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) through an incomplete host-env-security-policy.json configuration. The vulnerability requires local access and prior authentication to an OpenClaw instance, but enables full code execution with inherited privileges during compilation. No public exploit code has been identified at time of analysis.
Technical ContextAI
OpenClaw is a system for managing and executing untrusted workloads with restricted permissions through host-exec policies. The vulnerability stems from incomplete environment variable restrictions in the host-env-security-policy.json security policy file (CWE-427: Uncontrolled Search Path Element). The policy fails to block modification of critical compiler-invocation environment variables that determine which compiler binary is executed. When a user with approved host-exec permissions constructs a malicious request, they can inject environment variables that redirect standard compiler commands (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) to attacker-controlled binaries. Because build systems invoke these environment variables without further validation, the attacker's binary executes with the privileges of the build process, achieving code execution.
RemediationAI
Upgrade to OpenClaw 2026.3.31 or later. The vendor has released a patch via commit e277a37f896b5011a1df06e6490c6630074d0afa (https://github.com/openclaw/openclaw/commit/e277a37f896b5011a1df06e6490c6630074d0afa), which updates the host-env-security-policy.json to include explicit restrictions on compiler-related environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER). Until patching is possible, restrict approval of host-exec requests to only trusted users and implement additional environment variable filtering in any wrapper scripts that invoke OpenClaw. Audit existing host-exec permissions and revoke those granted to untrusted or semi-trusted accounts. Note that this is a policy-layer fix rather than code-level change, so patch deployment should be verified by inspecting the updated security policy file.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today