PT-2026-33872 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-03 · Updated 2026-04-21 · CVE-2026-41330

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description An environment variable override issue exists in the host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. This allows attackers to bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

Recommendations Update to version 2026.3.31 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-453

Related Identifiers

CVE-2026-41330

GHSA-9GP8-HJXR-6F34

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/4d912e04519b4bd53b248437c53748cdebce9a41 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9gp8-hjxr-6f34 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gp8-hjxr-6f34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41330 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-environment-variable-override-via-host-exec-policy · Note
• https://twitter.com/CVEnew/status/2046571873958494499 · Twitter Post