PT-2026-38239 · Openclaw · Openclaw

Feiyang666 · Published 2026-04-17 · Updated 2026-05-07 · CVE-2026-43584

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description An insufficient environment variable denylist in the exec environment policy allows operator-supplied overrides of high-risk interpreter startup variables. Specifically, the variables VIMINIT, EXINIT, LUA INIT, and HOSTALIASES can be manipulated to influence downstream execution behavior or network connectivity.

Recommendations Update to version 2026.4.10.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-43584

GHSA-VFP4-8X56-J7C5

GHSA-XRGF-R9GR-JJJF

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/commit/2d126fc62343a7b6895351f96e4e1474bc358140 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vfp4-8x56-j7c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43584 · Security Note
• https://osv.dev/vulnerability/GHSA-vfp4-8x56-j7c5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xrgf-r9gr-jjjf · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://reddit.com/r/pwnhub/comments/1t6amgb/critical_openclaw_security_flaw_exposes_system_to · Reddit Post
• https://twitter.com/VulmonFeeds/status/2052156407223357604 · Twitter Post
• https://vulncheck.com/advisories/openclaw-insufficient-environment-variable-denylist-in-exec-policy · Note
• https://twitter.com/CVEnew/status/2052430113694798166 · Twitter Post