CVE-2026-41294 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.28 contains an environment variable injection caused by loading the current working directory .env file before trusted state-dir configuration, letting attackers override runtime and security-sensitive settings during startup, exploit requires placing a malicious .env file in the workspace.

Severity & Score

Impact

Attackers can override runtime configuration and security-sensitive environment settings, potentially leading to privilege escalation or arbitrary code execution.

Mitigation

Update to version 2026.3.28 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq
• https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-cwd-env-file

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner