OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

높음 8.6CVE-2026-41294 · GHSA-8rh7-6779-cjqq · Published 21/04/2026 · updated 17/06/2026

요약

CVE-2026-41294은(는) openclaw (openclaw), openclaw에 영향을 주는 높음 (CVSS 8.6) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.13%, 전체 취약점의 2.6%보다 높음.
조치: 2026.3.28 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.3.28`	`2026.3.28`
openclaw npm	`< 2026.3.28`	`2026.3.28`

Description

Summary

OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

Impact

A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

Affected Component

src/infra/dotenv.ts, src/cli/dotenv.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).

NVD description

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment settings during OpenClaw startup.

References

openclaw/openclaw security advisory · WEB
openclaw/openclaw commit 6a79324 · WEB
openclaw/openclaw · PACKAGE
openclaw/openclaw release v2026.3.28 · WEB
vulncheck.com/advisories/openclaw-environment-variable-injection-via-cwd-env-file · Third Party Advisory

openclaw의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.3.28

2026.3.28

openclaw

npm

< 2026.3.28

2026.3.28

Description

Summary

OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

Impact

A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

Affected Component

src/infra/dotenv.ts, src/cli/dotenv.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).

NVD description

openclaw의 다른 취약점

모두 보기 →