CVE-2026-41387: OpenClaw RCE Vulnerability

CVE-2026-41387 Overview

CVE-2026-41387 is an incomplete host environment variable sanitization vulnerability affecting OpenClaw versions before 2026.3.22. The vulnerability exists in host-env-security-policy.json and host-env-security.ts files, which fail to properly sanitize package-manager environment overrides. This security flaw allows attackers to exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure, ultimately enabling execution of trojanized content.

Critical Impact
Attackers can leverage incomplete environment variable sanitization to redirect package resolution to malicious infrastructure, enabling supply chain attacks and execution of trojanized packages.

Affected Products

OpenClaw versions prior to 2026.3.22

Discovery Timeline

2026-04-28 - CVE-2026-41387 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41387

Vulnerability Analysis

This vulnerability falls under CWE-183 (Permissive List of Allowed Inputs), indicating that the security controls in OpenClaw fail to comprehensively restrict dangerous environment variable configurations. The incomplete sanitization in the host environment security policy allows certain package-manager environment variables to bypass security checks.

When OpenClaw processes exec requests, it applies environment variable filtering based on rules defined in host-env-security-policy.json and implemented in host-env-security.ts. However, the allowlist does not account for all package-manager-specific environment variables that can influence package resolution behavior. This gap enables attackers to inject environment overrides that redirect package fetching to attacker-controlled registries or mirrors.

The vulnerability requires local access and user interaction to exploit, but once triggered, can result in complete compromise of confidentiality, integrity, and availability on the vulnerable system.

Root Cause

The root cause lies in an incomplete allowlist implementation within the host environment security policy. The host-env-security-policy.json configuration and its TypeScript implementation in host-env-security.ts do not enumerate all environment variables that package managers (such as npm, pip, or similar tools) use to determine package resolution endpoints.

Specifically, certain environment variables that control registry URLs, mirror configurations, or proxy settings are not included in the sanitization blocklist, allowing them to pass through to child processes during approved exec operations.

Attack Vector

The attack requires local access to the system running the vulnerable OpenClaw version. An attacker can craft malicious environment variable configurations that:

Override default package registry endpoints to point to attacker-controlled infrastructure
Manipulate runtime bootstrap configurations to load malicious code
Redirect dependency resolution during legitimate exec requests

When a user triggers an approved exec request (requiring user interaction), the unsanitized environment variables are passed to the spawned process. This allows the attacker to intercept package resolution and serve trojanized packages, effectively turning legitimate software operations into supply chain attack vectors.

For detailed technical information on the exploitation mechanism, refer to the GitHub Security Advisory and VulnCheck Advisory.

Detection Methods for CVE-2026-41387

Indicators of Compromise

Unexpected modifications to package registry environment variables (e.g., NPM_CONFIG_REGISTRY, PIP_INDEX_URL, or similar)
Network connections to unknown or suspicious package registry endpoints during exec operations
Presence of trojanized dependencies or packages with unexpected checksums
Anomalous entries in host-env-security-policy.json configuration files

Detection Strategies

Monitor environment variable configurations passed to child processes spawned by OpenClaw
Implement network monitoring to detect package resolution requests to unauthorized registries
Audit changes to host-env-security-policy.json and host-env-security.ts files
Compare installed package checksums against known-good values from official registries

Monitoring Recommendations

Enable detailed logging for all exec requests processed by OpenClaw
Implement alerting for any package manager operations resolving to non-standard registry URLs
Deploy file integrity monitoring on OpenClaw configuration files
Establish baseline network behavior for package resolution and alert on deviations

How to Mitigate CVE-2026-41387

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.22 or later immediately
Review environment variable configurations on systems running vulnerable OpenClaw versions
Audit recent exec requests for any signs of package resolution redirection
Verify integrity of recently installed packages against official registry checksums

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.22. Users should upgrade to this version or later to receive the complete host environment variable sanitization fix. For additional details, consult the GitHub Security Advisory.

Workarounds

Implement strict network-level controls to restrict outbound connections to authorized package registries only
Manually review and harden host-env-security-policy.json to explicitly block package-manager environment overrides
Consider running OpenClaw in a containerized environment with restricted network access
Disable or restrict exec request functionality until the patch can be applied