OpenClaw CVE-2026-45003

The attacker must have local write access to the workspace .env file or a version control repository containing it. The vulnerability requires that a user with sufficient privileges to load workspace configuration read and process the malicious .env file (UI:R - user interaction is required to trigger dotenv loading in the affected versions). The vulnerable endpoint variables are specific to the four named connectors: Matrix (MATRIX_HOMESERVER, MATRIX_<ACCOUNT>_HOMESERVER patterns), Mattermost (MATTERMOST_URL), IRC (IRC_HOST), and Synology (SYNOLOGY_CHAT_INCOMING_URL, SYNOLOGY_NAS_HOST, plus generic *_API_HOST and *_BASE_URL suffixes). No authentication bypass or network access is required; exploitation is limited to local workspace access and depends on file write permissions and configuration reload. Non-vulnerable configurations include air-gapped or read-only workspace directories where users cannot modify .env files, and deployments using separate global runtime dotenv loading that is not overridden by workspace files.

CVSS score of 5.0 (local access, low complexity, low privilege, requires user interaction, no scope change, high confidentiality) indicates moderate risk grounded in realistic deployment constraints. The attack vector (AV:L) and privilege requirement (PR:L) mean this is not a network-exploitable vulnerability - an attacker must already have local workspace file access and trick a user into loading a malicious .env file (UI:R). EPSS data is not provided, limiting quantitative exploitation probability assessment. No active exploitation has been reported (not in CISA KEV), and no public exploit code is referenced. The real-world impact is confined to environments where an untrusted actor can modify workspace dotenv files - this is a realistic scenario in shared development environments or through compromised CI/CD pipelines, but not a widespread immediate threat. The high confidentiality impact (C:H) reflects that redirected traffic could enable man-in-the-middle attacks to intercept sensitive connector communications. CVSS vector and description align: local attacker with workspace access, no elevated privileges required beyond file write access, limited by user interaction requirement (loading the workspace). This is a legitimate but lower-priority vulnerability compared to network-based attacks; priority depends on the organization's workspace access control model and whether untrusted users can modify dotenv files.

An attacker with write access to a shared workspace (e.g., through a compromised developer account or by committing to a cloned workspace) creates a malicious .env file containing MATRIX_HOMESERVER=https://evil-matrix.example.com. When a workspace administrator or user loads the workspace configuration, OpenClaw reads the .env file and redirects all Matrix connector traffic through the attacker's endpoint, allowing the attacker to intercept authentication tokens, message content, and other sensitive data transmitted to the legitimate Matrix homeserver.