CVE-2026-41369: OpenClaw RCE Vulnerability

CVE-2026-41369 Overview

OpenClaw before version 2026.3.31 contains an insufficient environment variable sanitization vulnerability in host exec operations. The application fails to properly filter critical environment variables related to package managers, container registries, Docker configurations, compiler paths, and TLS/SSL certificate overrides. This Input Validation Error allows attackers with low privileges to inject malicious environment variables that can override critical system configurations and compromise host execution integrity.

Critical Impact
Attackers can manipulate package installation sources, Docker daemon connections, SSL/TLS certificate validation, and compiler include paths through environment variable injection, potentially leading to supply chain attacks or man-in-the-middle scenarios.

Affected Products

OpenClaw versions prior to 2026.3.31
OpenClaw for Node.js environments
OpenClaw macOS application

Discovery Timeline

April 28, 2026 - CVE-2026-41369 published to NVD
April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41369

Vulnerability Analysis

This vulnerability stems from improper exposure of resources to an unintended control sphere (CWE-668). OpenClaw's host execution functionality processes environment variables passed from user-controlled contexts without adequate validation or filtering. The vulnerable code path allows numerous dangerous environment variables to propagate to child processes during host exec operations.

The security implications are significant because many critical development tools rely on environment variables for configuration. When these variables can be arbitrarily set by an attacker, the entire build and execution pipeline becomes compromised. Package managers like pip and UV can be redirected to malicious repositories, Docker operations can be hijacked to connect to attacker-controlled daemons, and TLS verification can be completely bypassed.

Root Cause

The root cause is the absence of a comprehensive blocklist for security-sensitive environment variables in the host execution security policy. Prior to the patch, OpenClaw only filtered a limited subset of package manager index URLs but failed to account for additional pip configuration variables (PIP_CONFIG_FILE, PIP_FIND_LINKS, PIP_TRUSTED_HOST), Docker-related variables (DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH, DOCKER_CONTEXT), compiler path variables (LIBRARY_PATH, CPATH, C_INCLUDE_PATH, CPLUS_INCLUDE_PATH, OBJC_INCLUDE_PATH), TLS/SSL certificate override variables (NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, SSL_CERT_DIR, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE), and Go module proxy variables (GOPROXY, GONOSUMCHECK, GONOSUMDB, GONOPROXY, GOPRIVATE, GOENV).

Attack Vector

The vulnerability is exploitable over the network by authenticated users with low privileges. An attacker can craft requests that inject malicious environment variables during host exec operations. For example, setting DOCKER_HOST could redirect Docker commands to an attacker-controlled daemon, while manipulating SSL_CERT_FILE could bypass certificate validation for man-in-the-middle attacks.

The following patch shows the security fix that blocks risky host environment variable overrides:

text

         "PIP_INDEX_URL",
         "PIP_PYPI_URL",
         "PIP_EXTRA_INDEX_URL",
+        "PIP_CONFIG_FILE",
+        "PIP_FIND_LINKS",
+        "PIP_TRUSTED_HOST",
         "UV_INDEX",
         "UV_INDEX_URL",
         "UV_EXTRA_INDEX_URL",
         "UV_DEFAULT_INDEX",
+        "DOCKER_HOST",
+        "DOCKER_TLS_VERIFY",
+        "DOCKER_CERT_PATH",
+        "DOCKER_CONTEXT",
+        "LIBRARY_PATH",
+        "CPATH",
+        "C_INCLUDE_PATH",
+        "CPLUS_INCLUDE_PATH",
+        "OBJC_INCLUDE_PATH",
+        "NODE_EXTRA_CA_CERTS",
+        "SSL_CERT_FILE",
+        "SSL_CERT_DIR",
+        "REQUESTS_CA_BUNDLE",
+        "CURL_CA_BUNDLE",
+        "GOPROXY",
+        "GONOSUMCHECK",
+        "GONOSUMDB",
+        "GONOPROXY",
+        "GOPRIVATE",
+        "GOENV",

Source: GitHub Commit Update

Detection Methods for CVE-2026-41369

Indicators of Compromise

Unusual environment variable modifications in OpenClaw host exec operations
Package manager requests to unexpected or unauthorized index URLs
Docker commands attempting to connect to non-standard daemon sockets
SSL/TLS certificate path overrides pointing to untrusted locations
Unexpected compiler include path modifications in build processes

Detection Strategies

Monitor process execution logs for OpenClaw host exec operations with suspicious environment variable payloads
Implement network monitoring to detect package manager connections to unauthorized registries
Alert on Docker operations attempting to use non-default DOCKER_HOST values
Review application logs for environment variable injection patterns targeting security-sensitive variables

Monitoring Recommendations

Enable verbose logging for OpenClaw host execution operations
Implement allowlist-based environment variable policies for production deployments
Deploy network segmentation to restrict outbound connections from build systems
Use SentinelOne Singularity Platform to monitor for suspicious process spawning and environment manipulation

How to Mitigate CVE-2026-41369

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Audit existing deployments for any signs of environment variable exploitation
Review build artifacts for potential supply chain compromise
Implement network-level controls to restrict package manager and registry connections

Patch Information

The security patch is available in OpenClaw version 2026.3.31. The fix adds comprehensive blocking of risky environment variables in the host execution security policy. The patch is documented in commit eb8de6715f02949c21c4e895fffc8a6dcb00975c and detailed in the GitHub Security Advisory GHSA-cg7q-fg22-4g98.

Workarounds

Implement external environment variable filtering at the container or orchestration layer before invoking OpenClaw
Use network policies to restrict outbound connections to only approved package registries and Docker registries
Deploy application-level firewalls to monitor and block suspicious environment variable patterns
Consider running OpenClaw in isolated environments with minimal network access until patching is complete

bash

# Configuration example - restrict environment variables at container level
# Add to your container runtime configuration to block dangerous env vars
docker run --env-file=/etc/openclaw/allowed-env.list \
  --network=restricted-build-network \
  openclaw:latest