PT-2026-35557

CVE-2026-41369

Published

2026-04-03

Updated

2026-04-28

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description Insufficient environment variable sanitization in host exec operations allows for the injection of malicious environment variables. The system fails to filter variables related to packages, registries, Docker, compilers, and TLS overrides, which can be used to override critical system configurations and compromise host execution integrity.

Recommendations Update to version 2026.3.31.

Exploitability

Exploit

Fix

Impacts

Researchers

Tdjackey

Vendors

Affected products

Weakness enumeration

CWE-668: Exposure of Resource to Wrong Sphere

CWE-184: Incomplete List of Disallowed Inputs