CVE-2026-41915: Openclaw RCE Vulnerability

CVE-2026-41915 Overview

OpenClaw before version 2026.4.8 contains an environment variable injection vulnerability that fails to sanitize git plumbing environment variables during host exec operations. Attackers with local access can exploit this flaw by setting GIT_DIR and related environment variables to redirect git operations, potentially compromising repository integrity and enabling unauthorized modifications to version control state.

Critical Impact
Attackers can manipulate git operations by injecting environment variables, potentially redirecting repository operations to attacker-controlled locations and compromising code integrity.

Affected Products

OpenClaw versions prior to 2026.4.8
OpenClaw for Node.js (all platforms)

Discovery Timeline

2026-04-28 - CVE-2026-41915 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-41915

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-184: Incomplete List of Disallowed Inputs) where OpenClaw fails to sanitize the execution environment before performing host exec operations. The application does not filter out git-related environment variables such as GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, and other git plumbing variables that can fundamentally alter git's behavior.

When a user with local access executes OpenClaw operations, any pre-existing git environment variables in their session are passed through to child processes. This allows an attacker to redirect git operations to arbitrary directories, potentially enabling unauthorized access to different repositories or the creation of malicious git objects that could later be executed or deployed.

Root Cause

The root cause lies in the incomplete sanitization of the process environment before spawning git-related child processes. OpenClaw's execution environment handling did not include git plumbing environment variables in its list of filtered variables, allowing these potentially dangerous values to propagate to git operations. This oversight in the environment variable filtering logic created an attack surface where local users could manipulate the behavior of git commands executed by the application.

Attack Vector

The attack requires local access to a system running OpenClaw. An attacker can set malicious values for git environment variables before invoking OpenClaw operations. For example, by setting GIT_DIR to point to an attacker-controlled directory, subsequent git operations performed by OpenClaw would operate against the wrong repository. This could be exploited to:

Redirect commits and other git operations to a different repository
Inject malicious content into trusted repositories
Bypass integrity checks that rely on git metadata
Exfiltrate sensitive repository data to attacker-controlled locations

The security patch addresses this by restructuring the DNS pinning and proxy dispatch logic to ensure proper environment isolation:

typescript

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }

Source: GitHub Commit

Detection Methods for CVE-2026-41915

Indicators of Compromise

Unusual git environment variables (GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, GIT_ALTERNATE_OBJECT_DIRECTORIES) set in process environments
Git operations targeting unexpected directories or repositories
Anomalous repository modifications that don't align with expected user activity
Process execution logs showing OpenClaw operations with suspicious environment inheritance

Detection Strategies

Monitor for processes spawned by OpenClaw that have non-standard git environment variables set
Implement file integrity monitoring on critical git repositories to detect unauthorized modifications
Review application logs for git operations that reference unexpected paths
Use endpoint detection to identify environment variable manipulation before OpenClaw execution

Monitoring Recommendations

Enable verbose logging for OpenClaw operations to capture environment state
Configure alerts for git operations that access repositories outside expected paths
Implement process ancestry tracking to correlate environment variable settings with application behavior
Monitor for changes to .git directories in unexpected locations

How to Mitigate CVE-2026-41915

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later immediately
Audit systems for any signs of exploitation, particularly unexpected repository modifications
Review process environments for suspicious git-related environment variables
Restrict local access to systems running vulnerable OpenClaw versions

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.8. The fix is available through the GitHub Commit. Additional details are available in the GitHub Security Advisory.

Workarounds

Sanitize the environment before executing OpenClaw by explicitly unsetting git plumbing variables
Use process isolation (containers, sandboxes) to prevent environment variable inheritance
Implement wrapper scripts that clear dangerous environment variables before invoking OpenClaw
Restrict user permissions to minimize the impact of potential exploitation

bash

# Configuration example - Clear git environment variables before OpenClaw execution
unset GIT_DIR
unset GIT_WORK_TREE
unset GIT_INDEX_FILE
unset GIT_OBJECT_DIRECTORY
unset GIT_ALTERNATE_OBJECT_DIRECTORIES
unset GIT_CEILING_DIRECTORIES
# Then execute OpenClaw
openclaw <command>