PT-2026-39692

CVE-2026-45003

Published

2026-05-04

Updated

2026-05-11

Description by

CVSS 3.1

5.0

Medium

MetricsAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.22

Description Workspace dotenv files can be used to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. This allows attackers with workspace access to redirect runtime traffic to malicious endpoints by configuring endpoint variables within these files.

Recommendations Update to version 2026.4.22.

Exploitability

Exploit

Fix

Impacts

Researchers

Qi Deng

Vendors

Affected products

Weakness enumeration

CWE-427: Uncontrolled Search Path Element

CWE-441: Unintended Proxy or Intermediary (\'Confused Deputy\')