Which versions of OpenClaw are affected by CVE-2026-41387?

OpenClaw package manager versions prior to 2026.3.22 contain an environment variable injection vulnerability that allows local attackers to redirect package installations to malicious sources,…. A patch is available.

How to fix or mitigate CVE-2026-41387?

Within 24 hours: Identify all systems running OpenClaw package manager and document current version inventory. Within 7 days: Contact OpenClaw vendor for patch availability timeline and interim guidance; implement file integrity monitoring on package installation directories. Within 30 days: Apply vendor-released patch to version 2026.3.22 or later across all development, CI/CD, and deployment systems once available; conduct supply chain audit of packages installed during the vulnerability window.

OpenClaw CVE-2026-41387

Q: What is the CVSS score of CVE-2026-41387?

CVE-2026-41387 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26096 HIGH

Permissive List of Allowed Inputs (CWE-183)

2026-04-28 VulnCheck

GHSA-j7p2-qcwm-94v4

Information Disclosure Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 30, 2026 - 20:36 nvd

Patch available

Apr 28, 2026 - 21:01 EUVD

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:03 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

7.8 (HIGH) 8.5 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26096

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

CVE Published

Apr 28, 2026 - 18:09 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.

AnalysisAI

OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.

Technical ContextAI

This vulnerability affects OpenClaw's host environment security implementation, specifically in host-env-security-policy.json and host-env-security.ts modules. CWE-183 (Permissive List of Allowed Inputs) indicates the allowlist for environment variables fails to block package-manager-specific overrides like NPM_CONFIG_REGISTRY, BUNDLE_PATH, PIP_INDEX_URL, or similar variables used by package ecosystems. When OpenClaw executes approved package operations, these unsanitized variables persist in the spawned process environment, allowing attackers to manipulate dependency resolution paths. This is a classic supply chain attack primitive where the package manager's trust in environment configuration becomes an exploitation vector. The vulnerability sits at the intersection of process isolation, environment inheritance, and package manager security models.

RemediationAI

Upgrade to OpenClaw version 2026.3.22 or later, which implements comprehensive environment variable sanitization per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4. Until patching, implement compensating controls: restrict write access to workspace directories and configuration files to prevent .env file injection; audit and block environment variables matching package manager patterns (NPM_CONFIG_*, BUNDLE_*, PIP_*, MAVEN_OPTS, etc.) in process execution policies; monitor outbound connections from package manager processes for unexpected destinations using network egress controls; require code review for all project configuration changes including .npmrc, .yarnrc, Gemfile, requirements.txt and similar files. These mitigations reduce attack surface but may break legitimate workflows requiring custom package sources - test thoroughly and maintain allowlists for approved internal registries.