CVE-2026-41330

Sažetak

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

Reference

https://github.com/openclaw/openclaw/commit/4d912e04519b4bd53b248437c53748cdebce9a41
https://github.com/openclaw/openclaw/security/advisories/GHSA-9gp8-hjxr-6f34
https://www.vulncheck.com/advisories/openclaw-environment-variable-override-via-host-exec-policy

CVSS

Base:	4.4
Impact:	2.5
Exploitability:	1.8

Pristup

Vektor	Složenost	Autentikacija
LOCAL	LOW	LOW

Impact

Povjerljivost	Cjelovitost	Dostupnost
LOW	LOW	NONE

CVSS vektor

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Zadnje važnije ažuriranje

21-04-2026 - 00:16

Objavljeno

21-04-2026 - 00:16