PT-2026-34767 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-02 · Updated 2026-04-25 · CVE-2026-41336

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description Workspace .env files can override the OPENCLAW BUNDLED HOOKS DIR environment variable, which allows the loading of attacker-controlled hook code. This enables attackers to replace trusted default-on bundled hooks from untrusted workspaces to execute arbitrary code.

Recommendations Update to version 2026.3.31.

Fix

Weakness Enumeration

CWE-829

CWE-15

Related Identifiers

CVE-2026-41336

GHSA-3QPV-XF3V-MM45

GHSA-JX3C-247H-CXWP

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3qpv-xf3v-mm45 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qpv-xf3v-mm45 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jx3c-247h-cxwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41336 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-arbitrary-hook-code-execution-via-openclaw-bundled-hooks-dir-environment-variable-override · Note
• https://twitter.com/CVEnew/status/2048168371875901501 · Twitter Post