PT-2026-42596 · Npm · Openclaw

Published 2026-05-11 · Updated 2026-05-11

OSV

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h2vw-ph2c-jvwf. This link is maintained to preserve external references.

Original Description

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX API HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

Fix

Weakness Enumeration

CWE-441

Related Identifiers

GHSA-4MHR-CXR4-2PRM

Affected Products

Openclaw

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44992 · Security Note
• https://osv.dev/vulnerability/GHSA-4mhr-cxr4-2prm · Vendor Advisory
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwf · Note
• https://github.com/openclaw/openclaw/commit/2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1 · Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-minimax-api-host-override-via-workspace-dotenv · Note