PT-2026-35780 · Openclaw · Openclaw

Keensecuritylab + 2 · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41396

Mitre

CVSS v3.1

7.8

High

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW BUNDLED PLUGINS DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-41396

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41396 · Security Note
• https://twitter.com/CVEnew/status/2049227524199108987 · Twitter Post
• https://vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root · Note