CVE-2026-41330 — OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy

2026-09-28T18:06:21.760173+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

GHSA-9gp8-hjxr-6f34 — OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

2026-09-28T18:06:21.760303+00:00

Affected: npm: openclaw

## Summary Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

## Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `4d912e04519b4bd53b248437c53748cdebce9a41` — 2026-03-31T21:25:36+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

Most recent entries from all

CVE-2026-41330 — OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy

GHSA-9gp8-hjxr-6f34 — OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls