PT-2026-33861 · Openclaw+1 · Openclaw

Tdjackey · Published 2026-04-01 · Updated 2026-04-21 · CVE-2026-41294

OSV

CVSS v3.1

9.6

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

Impact

A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

Affected Component

src/infra/dotenv.ts, src/cli/dotenv.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

CWE-15

Related Identifiers

CVE-2026-41294

GHSA-8RH7-6779-CJQQ

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41294 · Security Note
• https://osv.dev/vulnerability/GHSA-8rh7-6779-cjqq · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/6a793248024dca7685f63bcceb64a0096fd1586d · Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Note
• https://vulncheck.com/advisories/openclaw-environment-variable-injection-via-cwd-env-file · Note