PT-2026-49759 · Openclaw · Openclaw

Feynman-Hou · CVE-2026-53842 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.2

Description An environment variable injection exists where workspace .env files can influence the Python runtime selection during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution. This occurs when a workspace .env in a repository is opened by a trusted operator.

Recommendations Update to version 2026.5.2. Run Gmail setup from trusted workspaces and clear workspace env overrides. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-53842

GHSA-9FR2-P65V-GQXQ

GHSA-FQ9J-VW4W-FR6V

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53842.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53842 · Security Note
• https://osv.dev/vulnerability/GHSA-fq9j-vw4w-fr6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53842 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fr2-p65v-gqxq · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/170160 · Telegram Post
• https://vulncheck.com/advisories/openclaw-arbitrary-python-runtime-execution-via-cloudsdk-python-environment-variable · Note
• https://t.me/cveNotify/168747 · Telegram Post
• https://t.me/cveNotify/168872 · Telegram Post