CVE-2026-41391
Environment Variable Injection in OpenClaw Enables Package Index Hijacking
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-184 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to redirect Python package-index traffic by exploiting unsanitized environment variables, potentially enabling interception or manipulation of package management operations.
This manipulation could compromise the integrity of software dependencies, which may indirectly affect compliance with standards and regulations that require maintaining software integrity and security, such as GDPR and HIPAA.
However, there is no explicit information in the provided resources linking this vulnerability directly to compliance violations or specific impacts on regulatory requirements.
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.3.31. It occurs because the software fails to properly sanitize the environment variables PIP_INDEX_URL and UV_INDEX_URL when running in host execution contexts.
As a result, attackers can inject malicious URLs into these environment variables, which allows them to redirect Python package-index traffic.
This means attackers can intercept or manipulate package management operations by exploiting the unsanitized environment variables.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to redirect Python package-index traffic during package management operations.
This redirection can enable attackers to intercept or manipulate the packages being installed or updated, potentially leading to the installation of malicious or tampered packages.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the environment variables PIP_INDEX_URL and UV_INDEX_URL are set in the host execution environment, as these variables are exploited to redirect Python package-index traffic.
You can use commands to inspect these environment variables in your system or within the context where OpenClaw is executed.
- On Linux or macOS, run: `echo $PIP_INDEX_URL` and `echo $UV_INDEX_URL` to see if these variables are set.
- On Windows Command Prompt, run: `echo %PIP_INDEX_URL%` and `echo %UV_INDEX_URL%`.
- Additionally, inspect the environment variables of the process running OpenClaw to verify if these variables are present and unsanitized.
If these variables are set to unexpected or suspicious URLs, it indicates potential exploitation or risk of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenClaw to version 2026.3.31 or later, where the vulnerability has been fixed by properly sanitizing and blocking the environment variables that can redirect Python package-index traffic.
If upgrading is not immediately possible, ensure that the environment variables PIP_INDEX_URL, UV_INDEX_URL, and related variables such as PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_DEFAULT_INDEX, and UV_EXTRA_INDEX_URL are unset or removed from the environment before running OpenClaw.
Implement environment sanitization policies to prevent untrusted or malicious overrides of these variables in host execution contexts.
Monitor and audit package management operations to detect any unusual redirection or package source changes.