PT-2026-35775 · Openclaw · Openclaw

Keensecuritylab + 2 · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41391

Mitre

CVSS v3.1

5.3

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

OpenClaw before 2026.3.31 fails to properly sanitize PIP INDEX URL and UV INDEX URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting malicious index URLs through unsanitized environment variables.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-41391

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7ggg-pvrf-458v · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41391 · Security Note
• https://vulncheck.com/advisories/openclaw-environment-variable-bypass-in-package-index-url-handling · Note