Which versions of OpenClaw are affected by CVE-2026-44114?

CVE-2026-44114 affects OpenClaw npm package versions before 2026.4.20, allowing malicious workspace configuration files to hijack critical runtime variables and redirect trusted operations to…. A patch is available.

How to fix or mitigate CVE-2026-44114?

Within 24 hours: Identify all systems and pipelines using OpenClaw npm package and document current versions via npm audit or package inventory tools. Within 7 days: Upgrade OpenClaw to version 2026.4.20 or later across all development, CI/CD, and build environments; verify upgrade completion via npm list openclaw. Within 30 days: Conduct code review of any source checkouts or installer executions performed with affected versions to confirm no malicious redirections occurred; implement workspace configuration controls to restrict dotenv file loading from untrusted sources.

OpenClaw CVE-2026-44114

Q: What is the CVSS score of CVE-2026-44114?

CVE-2026-44114 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28194 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-06 disclosure@vulncheck.com

GHSA-hxvm-xjvf-93f3

Information Disclosure Openclaw

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 21:03 EUVD

Source Code Evidence Fetched

May 06, 2026 - 20:35 vuln.today

Analysis Generated

May 06, 2026 - 20:35 vuln.today

CVE Published

May 06, 2026 - 20:16 nvd

HIGH 8.5

DescriptionCVE.org

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.

AnalysisAI

Environment variable namespace collision in OpenClaw npm package before version 2026.4.20 enables malicious workspace dotenv files to override critical runtime control variables including OPENCLAW_GIT_DIR, potentially redirecting trusted operations like source updates and installer flows to attacker-controlled paths. Exploitation requires user interaction (opening a malicious workspace) but no authentication, achieving high confidentiality and integrity impact within the local scope. CVSS 8.5 severity reflects the local attack vector with low complexity. No active exploitation confirmed (not in CISA KEV), but public exploit code exists via the GitHub security advisory demonstrating the attack surface. Fixed in version 2026.4.20 per vendor commit 018494fa.

Technical ContextAI

This vulnerability stems from CWE-184 (Incomplete List of Disallowed Inputs) in OpenClaw's dotenv configuration loader. The affected component (src/infra/dotenv.ts) loads environment variables from workspace-local .env files without adequately filtering the OPENCLAW_ namespace reserved for runtime control. The npm package openclaw implements a development environment manager that reads per-workspace configuration from .env files. Prior to the fix, the BLOCKED_WORKSPACE_DOTENV_PREFIXES list was incomplete, failing to reserve the entire OPENCLAW_ namespace. This allowed untrusted workspace .env files to inject variables like OPENCLAW_GIT_DIR, OPENCLAW_WORKSPACE_DIR, OPENCLAW_MDNS_HOSTNAME, and OPENCLAW_SESSION_CACHE_TTL_MS that control trusted operations during initialization, source synchronization, and installation workflows. The patch adds a blanket OPENCLAW_ prefix block to the workspace dotenv parser, implementing a fail-closed security model where new runtime-control variables inherit protection by default rather than requiring explicit enumeration.

RemediationAI

Upgrade the OpenClaw npm package to version 2026.4.20 or later immediately. Run 'npm update openclaw' or 'npm install openclaw@2026.4.20' in affected development environments. The fix is implemented in commit 018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6 available at https://github.com/openclaw/openclaw/commit/018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6, which adds comprehensive blocking of the OPENCLAW_ prefix in workspace dotenv parsing. Vendor advisory available at https://github.com/openclaw/openclaw/security/advisories/GHSA-hxvm-xjvf-93f3 confirms the patched version. If immediate upgrade is not feasible, implement compensating controls: restrict workspace sources to trusted repositories only, manually audit all .env files in existing workspaces for OPENCLAW_ variables before opening projects (filter via 'grep OPENCLAW_ .env'), and run OpenClaw with a restrictive file system sandbox that prevents modification of trusted paths. Note that the workaround of manual auditing creates operational overhead and is error-prone - it does not prevent exploitation if a malicious .env is missed during review. Organizations should prioritize the patch over workarounds given the low upgrade complexity (single package version bump with no breaking changes noted in the changelog).