CVE-2026-43584: OpenClaw RCE Vulnerability

CVE-2026-43584 Overview

CVE-2026-43584 is a high-severity vulnerability in OpenClaw versions before 2026.4.10. The flaw exists in the exec environment policy, which uses an insufficient environment variable denylist [CWE-184]. The policy fails to block operator-supplied overrides of high-risk interpreter startup variables, including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Authenticated attackers can manipulate these variables to alter downstream execution behavior or redirect network connectivity.

Critical Impact

Attackers with low-privilege access can override interpreter initialization variables to execute arbitrary code in spawned processes and influence DNS resolution through HOSTALIASES, compromising the confidentiality, integrity, and availability of the host environment.

Affected Products

• OpenClaw versions prior to 2026.4.10
• OpenClaw HostEnvSanitizer component (macOS Sources)
• Deployments using the default HostEnvSecurityPolicy exec environment policy

Discovery Timeline

• 2026-05-06 - CVE-2026-43584 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43584

Vulnerability Analysis

The vulnerability stems from an incomplete denylist in OpenClaw's exec environment policy. The policy enumerates environment variables that must not be inherited or overridden when spawning child processes, but the original list omits several interpreter startup variables. Attackers exploit this gap by supplying operator-controlled values for variables that interpreters and resolver libraries read at process startup.

Variables such as VIMINIT and EXINIT cause vim and ex to execute attacker-controlled commands on launch. LUA_INIT instructs the Lua interpreter to evaluate arbitrary code or load a chosen file before user scripts run. HOSTALIASES redirects unqualified hostname lookups to attacker-defined mappings, enabling traffic redirection without modifying /etc/hosts or requiring elevated privileges.

Root Cause

The root cause is an incomplete denylist pattern [CWE-184]. The HostEnvSecurityPolicy enumerated blockedKeys, blockedPrefixes, and blockedOverrideKeys, but did not separately enforce a list of inherited keys and prefixes that must always be stripped. Any interpreter startup variable not explicitly listed could be passed through to child processes.

Attack Vector

Exploitation requires network access and low privileges. An authenticated operator submits a request that sets one of the unblocked variables. When OpenClaw spawns a downstream process such as a Vim, Lua, or shell helper, the unsanitized variable is inherited and triggers attacker-controlled execution or hostname redirection.

// Security patch: apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift
 enum HostEnvSanitizer {
     /// Generated from src/infra/host-env-security-policy.json via scripts/generate-host-env-security-policy-swift.mjs.
     /// Parity is validated by src/infra/host-env-security.policy-parity.test.ts.
+    private static let blockedInheritedKeys = HostEnvSecurityPolicy.blockedInheritedKeys
+    private static let blockedInheritedPrefixes = HostEnvSecurityPolicy.blockedInheritedPrefixes
     private static let blockedKeys = HostEnvSecurityPolicy.blockedKeys
     private static let blockedPrefixes = HostEnvSecurityPolicy.blockedPrefixes
     private static let blockedOverrideKeys = HostEnvSecurityPolicy.blockedOverrideKeys

Source: GitHub Commit 2d126fc. The patch introduces blockedInheritedKeys and blockedInheritedPrefixes sets, expanding the sanitizer to strip interpreter startup variables before child process execution.

Detection Methods for CVE-2026-43584

Indicators of Compromise

• Process telemetry showing vim, ex, lua, or related interpreters spawned by OpenClaw worker processes with non-empty VIMINIT, EXINIT, or LUA_INIT environment variables.
• DNS resolution anomalies where short hostnames resolve to unexpected addresses correlated with HOSTALIASES being set in a child process environment.
• OpenClaw audit logs containing operator-submitted environment variables matching interpreter startup names.

Detection Strategies

• Inventory all OpenClaw deployments and verify whether the running version is below 2026.4.10.
• Hunt across endpoint and process telemetry for child processes inheriting environment variables in the names VIMINIT, EXINIT, LUA_INIT, or HOSTALIASES.
• Compare submitted operator payloads against the expanded denylist defined in the upstream host-env-security-policy.json.

Monitoring Recommendations

• Alert on any execution of interpreter binaries spawned by OpenClaw service accounts outside of expected automation paths.
• Monitor outbound DNS and TCP connections from OpenClaw workers for destinations not present in approved allowlists.
• Capture and retain process environment snapshots for forensic review of suspected exploitation attempts.

How to Mitigate CVE-2026-43584

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.10 or later, which contains the expanded denylist fix.
• Restrict operator submission of environment variables at the network boundary until the upgrade is complete.
• Audit existing operator-supplied environment overrides for the presence of interpreter startup variables.

Patch Information

The fix is delivered in commit 2d126fc62343a7b6895351f96e4e1474bc358140 and tracked under the GitHub Security Advisory GHSA-vfp4-8x56-j7c5. Additional context is available in the VulnCheck Advisory. The patch adds blockedInheritedKeys and blockedInheritedPrefixes to HostEnvSecurityPolicy and wires them into HostEnvSanitizer to strip interpreter startup and resolver variables.

Workarounds

• If patching is not immediately possible, configure a custom environment policy that explicitly denies VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES.
• Disable operator-supplied environment overrides entirely on exec policies that do not require them.
• Run OpenClaw worker processes under accounts that cannot resolve hostnames via HOSTALIASES lookups by setting RES_OPTIONS and similar resolver controls in a wrapper script.

# Configuration example: enforce extended denylist via wrapper before patching
unset VIMINIT EXINIT LUA_INIT HOSTALIASES
for var in $(env | awk -F= '/^(VIMINIT|EXINIT|LUA_INIT|HOSTALIASES)=/ {print $1}'); do
  unset "$var"
done
exec /usr/local/bin/openclaw "$@"