Which versions of OpenClaw are affected by CVE-2026-41396?

OpenClaw versions before 2026.3.31 contain a local code execution vulnerability that allows attackers to inject malicious plugins by manipulating workspace configuration files, requiring user…. A patch is available.

How to fix or mitigate CVE-2026-41396?

Within 24 hours: Identify all OpenClaw installations and their versions. Within 7 days: Upgrade all OpenClaw instances to version 2026.3.31 or later, and audit recent workspace configurations for suspicious .env file modifications. Within 30 days: Implement file integrity monitoring on workspace directories and provide security training to users on workspace source validation.

OpenClaw CVE-2026-41396

Q: What is the CVSS score of CVE-2026-41396?

CVE-2026-41396 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26104 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-28 VulnCheck

GHSA-qcj9-wwgw-6gm8

Code Injection Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:05 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

7.8 (HIGH) 8.5 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26104

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

HIGH 8.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

AnalysisAI

Local attackers can execute malicious code in OpenClaw versions before 2026.3.31 by placing crafted .env files in workspaces to override the OPENCLAW_BUNDLED_PLUGINS_DIR variable, bypassing plugin trust verification. The vulnerability enables code injection through untrusted plugins masquerading as verified components when users open compromised workspace configurations. EPSS data not available; CVSS v4.0 rates this 8.5 HIGH with local attack vector requiring user interaction. Vendor patch available via GitHub commit 330a9f98cb and release 2026.3.31.

Technical ContextAI

OpenClaw is a software platform that implements plugin trust verification by maintaining a trusted root directory for bundled plugins, specified via the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable. The vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where workspace-scoped .env configuration files can override this critical security boundary variable. When users open a workspace, OpenClaw processes its .env file to set environment variables, but fails to protect the OPENCLAW_BUNDLED_PLUGINS_DIR variable from being overridden. This allows attackers to redirect the plugin trust verification mechanism to an attacker-controlled directory containing malicious plugins. The affected CPE (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) indicates all versions prior to the 2026.3.31 release are vulnerable. The trust boundary violation enables code injection because the application executes plugins from the overridden directory path while believing they originate from the legitimate bundled plugins location, effectively bypassing trust-based security controls.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later, which contains the fix implemented in GitHub commit 330a9f98cb29c79b1c16a2117e03d6276a0d6289. Download the patched release from the official OpenClaw repository at https://github.com/openclaw/openclaw. Review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8 for additional implementation details. Until patching is complete, implement compensating controls by restricting workspace sources to trusted origins only - specifically, prohibit opening workspaces from untrusted repositories, email attachments, or external file shares. Configure filesystem permissions to prevent unauthorized modification of workspace .env files in shared environments. Audit existing workspace configurations for unexpected OPENCLAW_BUNDLED_PLUGINS_DIR overrides by searching for this variable in all .env files across workspace directories. Note that restricting workspace sources may limit collaboration workflows and require additional vetting processes for shared projects. Monitor plugin loading behavior through application logs to detect anomalous plugin directory paths. These workarounds reduce attack surface but do not eliminate the vulnerability - upgrading to the patched version remains the definitive remediation.