Executive Summary

OpenClaw versions before 2026.5.2 contain an environment variable injection vulnerability. This flaw allows attackers who have access to the repository to manipulate the CLOUDSDK_PYTHON environment variable via workspace .env files. By doing so, they can influence which Python runtime is selected during the Gmail setup process executed by gcloud. This manipulation can cause the setup to run through unintended local Python paths, potentially enabling arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with repository access to execute arbitrary code on the system by forcing the Gmail setup process to run using a malicious or unintended Python runtime. This could compromise the security of the environment where OpenClaw is used, potentially leading to unauthorized actions or data exposure.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for the presence and manipulation of the CLOUDSDK_PYTHON environment variable in workspace .env files within repositories accessible to operators.

You can inspect .env files in your workspace repositories for any suspicious or unintended CLOUDSDK_PYTHON variable settings that could influence the Python runtime used by gcloud during Gmail setup.

Suggested commands to detect potential exploitation include:

• Search for CLOUDSDK_PYTHON in .env files: `grep -r CLOUDSDK_PYTHON /path/to/workspace`
• Check environment variables during gcloud execution: `env | grep CLOUDSDK_PYTHON`
• Audit recent changes to .env files in repositories to detect unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Run Gmail setup only from trusted workspaces to avoid untrusted environment variable influence.
• Clear or remove any workspace environment overrides, especially the CLOUDSDK_PYTHON variable, until the system is patched.
• Keep channel and tool allowlists narrow to reduce exposure.
• Avoid sharing Gateways between untrusted users to maintain security boundaries.
• Disable the affected feature if it is not necessary.

Additionally, update OpenClaw to version 2026.5.2 or later where this vulnerability is patched.

Useful 0 Not Useful 0