CVE-2026-44114
OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.
Ver en NVDAnálisis
OpenClaw is susceptible to environment variable injection through malicious workspace dotenv files, which could allow an attacker to manipulate runtime behaviors like git directories. While the vulnerability is high severity, OpenClaw is not a core piece of infrastructure or a widely used tool within the standard web and mobile development ecosystem.
Severidad
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCWE-184EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.