OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XOpenclaw
APPOpenclaw< 2026.3.31
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
Related vulnerabilities
CVE-2026-43585CRITICAL9.2PL ✓same product
OpenClaw: ominięcie uwierzytelniania przez nieodświeżane tokeny bearer po rotacji SecretRef
CVE-2026-43575CRITICAL9.2PL ✓same product
OpenClaw: Authentication Bypass w trasie pomocniczej sandbox noVNC
CVE-2026-43578CRITICAL9.1PL ✓same product
OpenClaw: privilege escalation przez pominięcie zdarzeń async exec w heartbeat
CVE-2026-43581CRITICAL9.0PL ✓same product
OpenClaw: ekspozycja Chrome DevTools Protocol poza sandbox
CVE-2026-44109CRITICAL9.2PL ✓same product
OpenClaw — Auth Bypass w walidacji Feishu webhook umożliwia RCE