CVE-2026-41391: OpenClaw Auth Bypass Vulnerability

CVE-2026-41391 Overview

OpenClaw before version 2026.3.31 contains an input validation vulnerability that fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts. This security flaw allows attackers to redirect Python package-index traffic by injecting malicious index URLs through unsanitized environment variables, potentially enabling package management interception or manipulation.

Critical Impact

Attackers can exploit this bypass to intercept or manipulate package management operations, potentially leading to supply chain attacks through malicious package injection.

Affected Products

• OpenClaw versions prior to 2026.3.31

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-41391 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41391

Vulnerability Analysis

This vulnerability is classified under CWE-184 (Incomplete List of Disallowed Inputs), indicating that the security policy blocking dangerous environment variables was missing critical entries. OpenClaw's host environment security policy maintained a blocklist of environment variables that could be used to redirect or manipulate execution contexts. However, several Python package manager environment variables were not included in this blocklist, creating a security gap.

The flaw allows local attackers with limited privileges to inject environment variables that control where Python package managers fetch packages from. By setting variables like PIP_INDEX_URL or UV_INDEX_URL, an attacker can redirect package installations to a malicious index server, potentially delivering trojanized packages during installation operations.

Root Cause

The root cause is an incomplete blocklist in OpenClaw's host environment security policy. The HostEnvSecurityPolicy component was designed to prevent environment variable abuse but failed to include Python package index URL environment variables (PIP_INDEX_URL, PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, UV_EXTRA_INDEX_URL) in its disallowed list. This oversight allowed these variables to pass through unsanitized into host execution contexts.

Attack Vector

The attack requires local access and involves setting Python package manager environment variables before OpenClaw executes package management operations. An attacker with low privileges can:

1. Set environment variables like PIP_INDEX_URL to point to an attacker-controlled package index
2. Trigger package installation operations through OpenClaw
3. Intercept package requests or serve malicious packages from the rogue index

The security patch adds the missing environment variables to the blocklist:

         "PHP_INI_SCAN_DIR",
         "DENO_DIR",
         "BUN_CONFIG_REGISTRY",
+        "PIP_INDEX_URL",
+        "PIP_PYPI_URL",
+        "PIP_EXTRA_INDEX_URL",
+        "UV_INDEX",
+        "UV_INDEX_URL",
+        "UV_DEFAULT_INDEX",
+        "UV_EXTRA_INDEX_URL",
         "LUA_PATH",
         "LUA_CPATH",
         "GEM_HOME",

Source: GitHub Commit Changes

Detection Methods for CVE-2026-41391

Indicators of Compromise

• Unexpected values in PIP_INDEX_URL, UV_INDEX_URL, or related Python package index environment variables
• Package installation traffic directed to non-standard or unknown package index servers
• Process execution logs showing OpenClaw with suspicious environment variable configurations

Detection Strategies

• Monitor environment variable configurations for Python package manager index URL variables in OpenClaw execution contexts
• Implement network monitoring to detect package installation traffic to unauthorized index servers
• Audit system logs for unexpected environment variable manipulation prior to OpenClaw operations

Monitoring Recommendations

• Enable logging for environment variable changes in systems running OpenClaw
• Configure network security tools to alert on connections to non-PyPI package indexes during OpenClaw operations
• Implement file integrity monitoring on OpenClaw configuration and policy files

How to Mitigate CVE-2026-41391

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.31 or later immediately
• Audit existing OpenClaw installations for signs of exploitation
• Review installed Python packages for unexpected or tampered dependencies

Patch Information

The security fix is available in OpenClaw version 2026.3.31 and later. The patch modifies both HostEnvSecurityPolicy.generated.swift (macOS) and host-env-security-policy.json (infrastructure) to add the missing Python package index environment variables to the blocklist. For detailed patch information, see the GitHub Commit and the GitHub Security Advisory.

Workarounds

• Manually clear or unset Python package index environment variables (PIP_INDEX_URL, PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, UV_EXTRA_INDEX_URL) before running OpenClaw operations
• Implement strict environment variable controls at the system level to prevent unauthorized modifications
• Use network-level controls to restrict package installation traffic to authorized PyPI mirrors only

# Clear Python package index environment variables before OpenClaw execution
unset PIP_INDEX_URL PIP_PYPI_URL PIP_EXTRA_INDEX_URL
unset UV_INDEX UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL