PT-2026-35775

CVE-2026-41391

Published

2026-04-02

Updated

2026-04-30

Description by

CVSS 3.1

6.1

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description Insufficient sanitization of the PIP INDEX URL and UV INDEX URL environment variables in host execution contexts allows attackers to redirect Python package-index traffic. This can lead to the interception or manipulation of package management operations by injecting malicious index URLs.

Recommendations Update to version 2026.3.31 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Qclawer

Vendors

Affected products

Weakness enumeration