CVE-2026-41369
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
OpenClaw before version 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can inject malicious environment variables to override critical system configurations.
Risk Assessment
An attacker can take control of command execution on the host, potentially leading to full system compromise.
Recommendation
Update OpenClaw to version 2026.3.31 or later.
Original NVD description (English source)
OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.