Skip to content
CVSS 7.8 · HIGH

CVE-2026-41396

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Ver en NVD

Análisis

OpenClaw is a niche software project where a workspace configuration vulnerability allows for malicious plugin injection via environment variable overrides. Since the tool is not widely used within the general web or backend developer community, it does not warrant a high-tier alert.

Severidad

Puntaje: 7.8(HIGH)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV: LOCAL
AC: LOW
PR: NONE
UI: REQUIRED
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-829

EPSS

Probabilidad de explotación (próx. 30 días): 0.0001 (0.0%)
Percentil: 2.0%
EPSS: 2026-05-06

Afecta

openclaw:openclaw

Descripción técnica

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Publicada: 28/4/2026, 19:37:43
Última modificación: 30/4/2026, 20:50:00

Referencias

InicioEventosBlogRecursosEquipo