CVE-2026-44114
OpenClaw Workspace Environment Variable Override Vulnerability
Publication date: 2026-05-06
Last updated on: 2026-05-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-184 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.4.20. The software fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files. This flaw allows attackers to override critical runtime variables by setting malicious environment variables such as OPENCLAW_GIT_DIR. By doing so, attackers can manipulate trusted OpenClaw runtime behavior during source-update or installer processes.
How can this vulnerability impact me? :
The vulnerability can lead to attackers manipulating the runtime behavior of OpenClaw by overriding critical environment variables. This manipulation can affect source-update or installer flows, potentially allowing unauthorized changes or disruptions in the software's operation. Given the high CVSS scores (8.5 in v4.0 and 7.8 in v3.1), the impact includes high confidentiality, integrity, and availability risks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves malicious workspace dotenv files overriding critical OpenClaw runtime-control environment variables prefixed with OPENCLAW_. Detection involves checking workspace .env files for unauthorized or suspicious OPENCLAW_ variables.
You can inspect workspace dotenv files for environment variables starting with OPENCLAW_ that should not be set or modified. For example, use commands to search for such variables in .env files:
- grep -r '^OPENCLAW_' /path/to/workspace/.env
- grep -r 'OPENCLAW_GIT_DIR' /path/to/workspace/.env
Additionally, monitor environment variables in running OpenClaw processes to detect if any critical runtime variables have been overridden unexpectedly.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade OpenClaw to version 2026.4.20 or later, where the OPENCLAW_ namespace is properly reserved and workspace dotenv files cannot override critical runtime-control variables.
Until the upgrade is applied, avoid running OpenClaw from untrusted or attacker-controlled workspaces that contain malicious .env files.
Review and remove any workspace dotenv files that set OPENCLAW_ prefixed environment variables, especially variables like OPENCLAW_GIT_DIR, OPENCLAW_WORKSPACE_DIR, OPENCLAW_MDNS_HOSTNAME, and OPENCLAW_SESSION_CACHE_TTL_MS.
Implement monitoring to detect unauthorized changes to environment variables related to OpenClaw runtime control.