Is there a patch available for CVE-2026-45003?

Yes, a patch is available for CVE-2026-45003. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-45003

Q: What is the CVSS score of CVE-2026-45003?

CVE-2026-45003 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29148 MEDIUM

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-05-11 VulnCheck

GHSA-5jgm-f9wr-9qm7

Information Disclosure Synology Mattermost Openclaw

4.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 11, 2026 - 18:22 NVD

5.0 (MEDIUM) 4.1 (MEDIUM)

Source Code Evidence Fetched

May 11, 2026 - 17:48 vuln.today

Analysis Generated

May 11, 2026 - 17:48 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.22.

DescriptionCVE.org

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

AnalysisAI

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors, enabling local attackers with workspace access to redirect runtime traffic to malicious endpoints. The vulnerability requires local access and user interaction but allows high confidentiality impact through traffic interception. No active exploitation has been identified, but a vendor-released patch is available.

Technical ContextAI

OpenClaw uses dotenv files to manage environment configuration for bundled connectors that integrate with Matrix, Mattermost, IRC, and Synology endpoints. The vulnerability exists in the workspace dotenv loading mechanism (loadWorkspaceDotEnvFile function in src/infra/dotenv.ts), which failed to block sensitive endpoint-related environment variables. An attacker with workspace file access could craft a .env file containing variables like MATRIX_HOMESERVER, MATTERMOST_URL, IRC_HOST, SYNOLOGY_CHAT_INCOMING_URL, SYNOLOGY_NAS_HOST, or per-account Matrix homeserver suffixes (MATRIX_<ACCOUNT>_HOMESERVER) to override the operator-configured endpoints. The root cause (CWE-441: Unintended Proxy or Intermediary) stems from insufficient input validation and lack of blocklist enforcement in the dotenv loader. The fix implements a blocklist (BLOCKED_WORKSPACE_DOTENV_KEYS and BLOCKED_WORKSPACE_DOTENV_SUFFIXES) that prevents workspace .env files from overriding these critical connector configuration values while allowing trusted global runtime dotenv loading to remain separate.

RemediationAI

Vendor-released patch: upgrade to OpenClaw 2026.4.22 or later. The patch is published on npm and the compiled package contains the fix (commit 0623079e98abf7202591f1b04a89755eb7ec9272 is contained in the v2026.4.22 release tag). For deployments unable to upgrade immediately, restrict write access to workspace .env files to trusted administrators only - prevent untrusted users and automated processes from modifying or committing .env files into shared workspaces. Additionally, audit existing .env files in all workspaces for the presence of suspicious endpoint variables (MATRIX_HOMESERVER, MATTERMOST_URL, IRC_HOST, SYNOLOGY_CHAT_INCOMING_URL, SYNOLOGY_NAS_HOST, or *_HOMESERVER patterns) and verify that connector traffic is reaching the intended endpoints rather than attacker-controlled hosts. The patch blocks these variables at load time, but compensating controls depend on enforcing file-level access controls and monitoring endpoint configurations.