CVE-2026-41368: Openclaw Information Disclosure Flaw

CVE-2026-41368 Overview

CVE-2026-41368 is an environment variable disclosure vulnerability in OpenClaw before version 2026.3.28. The vulnerability exists in the jq safe-bin policy which fails to block the $ENV filter. This allows attackers to bypass safe-bin restrictions by using $ENV in jq programs to access sensitive environment variables that should be restricted.

Critical Impact
Attackers can bypass intended security restrictions to access sensitive environment variables, potentially exposing credentials, API keys, secrets, and other confidential configuration data stored in the process environment.

Affected Products

OpenClaw versions prior to 2026.3.28
OpenClaw for Node.js (all affected versions)

Discovery Timeline

2026-04-28 - CVE-2026-41368 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41368

Vulnerability Analysis

This vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere), which describes a scenario where a resource is made accessible to actors who should not have access to it. In the context of OpenClaw, the jq safe-bin policy is designed to restrict what jq filters and operations users can execute, preventing access to sensitive system resources.

The core issue lies in an incomplete filter blocklist within the safe-bin policy. While the policy blocks many potentially dangerous jq operations, it fails to restrict the $ENV built-in variable. The $ENV variable in jq provides a direct mapping to all environment variables accessible to the jq process, making it a significant security risk when unrestricted access is granted to untrusted users.

Root Cause

The root cause is an incomplete security policy implementation in the jq safe-bin configuration. The safe-bin policy was designed to sandbox jq execution by blocking access to potentially dangerous filters and functions. However, the $ENV filter was not included in the blocklist, creating a bypass opportunity. Environment variables commonly contain sensitive data such as database credentials, API tokens, cloud provider secrets, and internal service URLs, making this oversight a significant information disclosure risk.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker with the ability to supply jq programs to OpenClaw can craft malicious queries that leverage the $ENV filter to enumerate and extract environment variables from the server process. This could be achieved by submitting a jq query containing $ENV or accessing specific variables like $ENV.SECRET_KEY or $ENV.DATABASE_URL.

The attack does not require user interaction and has no impact on system integrity or availability—it is purely an information disclosure vector that could expose highly confidential configuration data.

Detection Methods for CVE-2026-41368

Indicators of Compromise

Presence of $ENV references in jq query logs or input parameters
Unexpected access patterns to jq-processing endpoints with environment variable extraction attempts
Application logs showing jq programs containing $ENV, .ENV, or similar environment access patterns

Detection Strategies

Implement input validation logging to capture and analyze all jq queries submitted to OpenClaw
Deploy web application firewall (WAF) rules to detect and alert on $ENV patterns in request payloads
Enable verbose logging on jq execution to capture full query strings for security review
Use runtime application self-protection (RASP) to monitor for environment variable access attempts

Monitoring Recommendations

Monitor application logs for jq queries containing environment variable access patterns
Set up alerts for unusual patterns of data exfiltration or large response sizes from jq endpoints
Implement anomaly detection for API endpoints that process jq queries
Review audit logs regularly for signs of reconnaissance or credential harvesting activity

How to Mitigate CVE-2026-41368

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.28 or later immediately
Review environment variables in affected systems and rotate any potentially exposed credentials
Audit logs for any historical exploitation attempts using $ENV filter patterns
Implement additional input validation to reject jq queries containing $ENV as a defense-in-depth measure

Patch Information

The vendor has addressed this vulnerability in OpenClaw version 2026.3.28. Users should upgrade to this version or later to ensure the $ENV filter is properly blocked by the safe-bin policy. For detailed patch information, refer to the GitHub Security Advisory.

Additional technical details are available in the VulnCheck Advisory.

Workarounds

Implement a custom input filter to reject any jq queries containing $ENV before they reach OpenClaw
Use a reverse proxy or WAF to block requests containing environment variable access patterns
Minimize sensitive data stored in environment variables where possible, using secrets management solutions instead
Restrict network access to OpenClaw instances to trusted sources only until patching is complete

bash

# Example: Block $ENV patterns at the application layer
# Add input validation before processing jq queries
if echo "$JQ_QUERY" | grep -qE '\$ENV|\.ENV'; then
    echo "Error: Environment variable access is not permitted"
    exit 1
fi