EUVD-2026-29140
GHSA-p3m6-jr2h-hhxj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to spawned MCP server processes, enabling code injection when operators start sessions using those servers.
AnalysisAI
Remote code execution in OpenClaw npm package versions before 2026.4.20 allows local authenticated users to inject malicious code through MCP stdio server environment variables. Attackers craft workspace configurations containing dangerous environment variables (NODE_OPTIONS, LD_PRELOAD, BASH_ENV) that execute arbitrary code when operators start sessions using those MCP servers. Vendor-released patch available (version 2026.4.20). No public exploit code or active exploitation confirmed at time of analysis, though VulnCheck published detailed technical advisory. CVSS 7.3 reflects local attack vector requiring user interaction, limiting widespread exploitation risk despite high technical impact.
Technical ContextAI
The vulnerability exists in OpenClaw's Model Context Protocol (MCP) stdio server configuration handling, specifically in the mcp-config-shared.ts and mcp-stdio.ts modules. MCP servers are child processes spawned by OpenClaw to provide extended capabilities. The affected code failed to validate environment variables passed from workspace configuration files before spawning these child processes. This allows injection of process-startup environment variables that control runtime behavior across multiple interpreters: NODE_OPTIONS (Node.js runtime flags enabling require preloads), LD_PRELOAD (Linux dynamic linker library injection), and BASH_ENV (shell initialization scripts). The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) - the application trusted workspace configuration data to define the execution environment of privileged child processes without sanitization. The patch introduces toMcpEnvRecord() function that filters environment entries through isDangerousHostEnvVarName() and isDangerousHostEnvOverrideVarName() denylists before process spawning, while preserving the original toMcpStringRecord() for non-environment use cases like HTTP headers.
RemediationAI
Upgrade to OpenClaw version 2026.4.20 or later via npm package manager (npm update openclaw). Vendor-confirmed fix implemented in commits 62fa5071896e95edc7f67d1cebc70a2859e283af and 85d86ebc4bf3d2226d39d132a484f4f7a299fa1b, available at GitHub repository. For organizations unable to immediately upgrade: (1) Restrict OpenClaw usage to trusted workspace configurations only - implement code review for all .openclaw or MCP configuration files before execution, particularly env sections in stdio server definitions; (2) Run OpenClaw processes in sandboxed environments (containers, VMs) with restricted permissions to limit code execution impact - note this reduces lateral movement risk but does not prevent initial compromise within the sandbox; (3) Monitor spawned MCP server processes for suspicious environment variables (NODE_OPTIONS, LD_PRELOAD, BASH_ENV, DYLD_INSERT_LIBRARIES) using process auditing tools - creates detection capability but allows initial execution. All workarounds have operational overhead and do not provide equivalent security to patching. Advisory and patch details: https://github.com/openclaw/openclaw/security/advisories/GHSA-mj59-h3q9-ghfh.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Share
External POC / Exploit Code
Leaving vuln.today