CVE-2026-42427
Remote Code Execution in OpenClaw via Malicious Build Environment Variables
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-184 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-42427 is a remote code execution vulnerability in OpenClaw versions before 2026.4.8 caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS.
Because these environment variables were not properly denied, attackers can inject malicious build tool environment variables that influence host execution commands, allowing them to execute arbitrary code on the affected system.
This vulnerability relates to improper neutralization of special elements used in OS commands (CWE-78) and an incomplete list of disallowed inputs (CWE-184).
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited privileges to execute arbitrary code on the host system by injecting malicious environment variables during the build process.
Successful exploitation could lead to unauthorized control over the affected system, potentially compromising system integrity and confidentiality.
Because the attack vector requires local access with some privileges (low privileges), the risk is medium severity but still significant.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS in OpenClaw versions prior to 2026.4.8. Detection would involve checking if these environment variables are present and potentially influencing build tool executions.
You can inspect the environment variables used during build tool execution to see if any of the vulnerable variables are set. For example, on a Unix-like system, you can run commands such as:
- env | grep -E 'HGRCPATH|CARGO_BUILD_RUSTC_WRAPPER|RUSTC_WRAPPER|MAKEFLAGS'
- ps auxwwwe | grep openclaw # to check environment variables of running OpenClaw processes
Additionally, reviewing the OpenClaw version installed can help determine if the system is vulnerable:
- openclaw --version
If the version is prior to 2026.4.8 and the environment variables are not properly denied, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade OpenClaw to version 2026.4.8 or later, where the missing environment variable denylist entries have been added and the vulnerability fixed.
Until the upgrade can be performed, you should ensure that the environment variables HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS are not set or controlled by untrusted users during build tool execution.
Restrict permissions and access to the build environment to prevent injection of malicious environment variables.
Monitor and audit build processes for unusual or unexpected environment variables that could influence execution.