Skip to content
CVSS 7.8 · HIGH

CVE-2026-41396

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

View on NVD

Analysis

OpenClaw is a niche software project where a workspace configuration vulnerability allows for malicious plugin injection via environment variable overrides. Since the tool is not widely used within the general web or backend developer community, it does not warrant a high-tier alert.

Severity

Score: 7.8(HIGH)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV: LOCAL
AC: LOW
PR: NONE
UI: REQUIRED
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-829

EPSS

Probability of exploitation (next 30 days): 0.0001 (0.0%)
Percentile: 2.0%
EPSS: 2026-05-06

Affects

openclaw:openclaw

Technical description

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Published: 4/28/2026, 7:37:43 PM
Last modified: 4/30/2026, 8:50:00 PM

References

HomeEventsBlogResourcesTeam