PT-2026-42596 · Npm · Openclaw

Publicado 2026-05-11 · Atualizado 2026-05-11

OSV

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h2vw-ph2c-jvwf. This link is maintained to preserve external references.

Original Description

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX API HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

Correção

Enumeração de Fraquezas

CWE-441

Identificadores relacionados

GHSA-4MHR-CXR4-2PRM

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwf · Nota
• https://github.com/openclaw/openclaw/commit/2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1 · Nota
• https://github.com/openclaw/openclaw · Nota
• https://vulncheck.com/advisories/openclaw-minimax-api-host-override-via-workspace-dotenv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44992 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4mhr-cxr4-2prm · Aviso do Fabricante