CVE-2026-41915: Openclaw RCE Vulnerability

CVE-2026-41915 Overview

OpenClaw before version 2026.4.8 contains an environment variable injection vulnerability that fails to sanitize git plumbing environment variables during host exec operations. Attackers with local access can exploit this flaw by setting GIT_DIR and related environment variables to redirect git operations, potentially compromising repository integrity and enabling unauthorized modifications to version control state.

Critical Impact

Attackers can manipulate git operations by injecting environment variables, potentially redirecting repository operations to attacker-controlled locations and compromising code integrity.

Affected Products

• OpenClaw versions prior to 2026.4.8
• OpenClaw for Node.js (all platforms)

Discovery Timeline

• 2026-04-28 - CVE-2026-41915 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-41915

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-184: Incomplete List of Disallowed Inputs) where OpenClaw fails to sanitize the execution environment before performing host exec operations. The application does not filter out git-related environment variables such as GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, and other git plumbing variables that can fundamentally alter git's behavior.

When a user with local access executes OpenClaw operations, any pre-existing git environment variables in their session are passed through to child processes. This allows an attacker to redirect git operations to arbitrary directories, potentially enabling unauthorized access to different repositories or the creation of malicious git objects that could later be executed or deployed.

Root Cause

The root cause lies in the incomplete sanitization of the process environment before spawning git-related child processes. OpenClaw's execution environment handling did not include git plumbing environment variables in its list of filtered variables, allowing these potentially dangerous values to propagate to git operations. This oversight in the environment variable filtering logic created an attack surface where local users could manipulate the behavior of git commands executed by the application.

Attack Vector

The attack requires local access to a system running OpenClaw. An attacker can set malicious values for git environment variables before invoking OpenClaw operations. For example, by setting GIT_DIR to point to an attacker-controlled directory, subsequent git operations performed by OpenClaw would operate against the wrong repository. This could be exploited to:

1. Redirect commits and other git operations to a different repository
2. Inject malicious content into trusted repositories
3. Bypass integrity checks that rely on git metadata
4. Exfiltrate sensitive repository data to attacker-controlled locations

The security patch addresses this by restructuring the DNS pinning and proxy dispatch logic to ensure proper environment isolation:

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }
 

Source: GitHub Commit

Detection Methods for CVE-2026-41915

Indicators of Compromise

• Unusual git environment variables (GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, GIT_ALTERNATE_OBJECT_DIRECTORIES) set in process environments
• Git operations targeting unexpected directories or repositories
• Anomalous repository modifications that don't align with expected user activity
• Process execution logs showing OpenClaw operations with suspicious environment inheritance

Detection Strategies

• Monitor for processes spawned by OpenClaw that have non-standard git environment variables set
• Implement file integrity monitoring on critical git repositories to detect unauthorized modifications
• Review application logs for git operations that reference unexpected paths
• Use endpoint detection to identify environment variable manipulation before OpenClaw execution

Monitoring Recommendations

• Enable verbose logging for OpenClaw operations to capture environment state
• Configure alerts for git operations that access repositories outside expected paths
• Implement process ancestry tracking to correlate environment variable settings with application behavior
• Monitor for changes to .git directories in unexpected locations

How to Mitigate CVE-2026-41915

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.8 or later immediately
• Audit systems for any signs of exploitation, particularly unexpected repository modifications
• Review process environments for suspicious git-related environment variables
• Restrict local access to systems running vulnerable OpenClaw versions

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.8. The fix is available through the GitHub Commit. Additional details are available in the GitHub Security Advisory.

Workarounds

• Sanitize the environment before executing OpenClaw by explicitly unsetting git plumbing variables
• Use process isolation (containers, sandboxes) to prevent environment variable inheritance
• Implement wrapper scripts that clear dangerous environment variables before invoking OpenClaw
• Restrict user permissions to minimize the impact of potential exploitation

# Configuration example - Clear git environment variables before OpenClaw execution
unset GIT_DIR
unset GIT_WORK_TREE
unset GIT_INDEX_FILE
unset GIT_OBJECT_DIRECTORY
unset GIT_ALTERNATE_OBJECT_DIRECTORIES
unset GIT_CEILING_DIRECTORIES
# Then execute OpenClaw
openclaw <command>