Is there a patch available for CVE-2026-44992?

Yes, a patch is available for CVE-2026-44992. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-44992

Q: What is the CVSS score of CVE-2026-44992?

CVE-2026-44992 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29137 MEDIUM

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-05-11 VulnCheck

GHSA-4mhr-cxr4-2prm

Code Injection Openclaw

4.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 11, 2026 - 18:22 NVD

5.0 (MEDIUM) 4.1 (MEDIUM)

Source Code Evidence Fetched

May 11, 2026 - 17:47 vuln.today

Analysis Generated

May 11, 2026 - 17:47 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.5.

DescriptionCVE.org

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

AnalysisAI

OpenClaw versions 2026.4.5 through 2026.4.19 allow local attackers with user privileges to redirect credentialed MiniMax API requests to attacker-controlled servers via environment variable injection in workspace dotenv files, exposing MiniMax API keys in Authorization headers. The vulnerability requires user interaction (opening a malicious workspace) and local access but achieves high confidentiality impact by exfiltrating sensitive API credentials.

Technical ContextAI

OpenClaw is an AI development platform (npm package) that integrates with the MiniMax API for speech and vision features. The vulnerability stems from CWE-441 (Unintended Proxy or Intermediary) combined with improper input validation of workspace-level .env files. The dotenv loader fails to blocklist the MINIMAX_API_HOST environment variable, allowing a workspace .env file to override the API endpoint URL. When OpenClaw initializes MiniMax features (speech-provider and minimax-vlm agent), it reads MINIMAX_API_HOST from process.env without validating whether it came from a trusted source (application-level config) or untrusted source (workspace .env). The attacker-supplied URL receives the Authorization header containing the MiniMax API key, which is embedded in all requests to the MiniMax API. The root cause is the absence of environment variable filtering in the workspace dotenv loading logic (src/infra/dotenv.ts loadWorkspaceDotEnvFile function).

RemediationAI

Vendor-released patch: OpenClaw 2026.4.20. Upgrade immediately from any version 2026.4.5 through 2026.4.19 to 2026.4.20 or later. The patch adds MINIMAX_API_HOST to the BLOCKED_WORKSPACE_DOTENV_KEYS set in src/infra/dotenv.ts and extends the BLOCKED_WORKSPACE_DOTENV_SUFFIXES blocklist to include _API_HOST to prevent future environment variable injection for API endpoint URLs. Additionally, the fix removes env-driven URL routing from the MiniMax request paths, replacing dynamic URL construction with hardcoded trusted API endpoints (https://api.minimaxi.com for VLM and speech TTS services). See patch commit 2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1 and advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwf for detailed changes. If immediate upgrade is not feasible, avoid opening or working from untrusted workspace directories and review any existing workspace .env files for MINIMAX_API_HOST or similar suspicious API endpoint variables; however, this is not a reliable defense against determined attackers with file system access.