EUVD-2026-25949

🗓️ 27 Apr 2026 23:24:31Reported by EUVDType

OpenClaw before 2026.3.31 lacks host env var sanitization, enabling injection to override settings.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-41369	27 Apr 202623:24	–	attackerkb
CNNVD	OpenClaw 安全漏洞	28 Apr 202600:00	–	cnnvd
CVE	CVE-2026-41369	27 Apr 202623:24	–	cve
Cvelist	CVE-2026-41369 OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution	27 Apr 202623:24	–	cvelist
Github Security Blog	Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables	28 Apr 202600:31	–	github
Github Security Blog	OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables	3 Apr 202603:07	–	github
NVD	CVE-2026-41369	28 Apr 202600:16	–	nvd
OSV	GHSA-5MH4-3RV3-FPCF Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables	28 Apr 202600:31	–	osv
OSV	GHSA-CG7Q-FG22-4G98 OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables	3 Apr 202603:07	–	osv
OSV	MINI-MVF5-H2V6-QVHP	29 Apr 202621:02	–	osv

[
  {
    "enisaIdVendor": [
      {
        "id": "281eb0f4-5dce-3b77-9966-593c35604fc8",
        "vendor": {
          "name": "OpenClaw"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "281eb0f4-5dce-3b77-9966-593c35604fc8",
        "product": {
          "name": "OpenClaw"
        },
        "product_version": ""
      },
      {
        "id": "f295f8c1-df2a-38e0-81c2-fc3922bb1310",
        "product": {
          "name": "OpenClaw"
        },
        "product_version": "0 <2026.3.31"
      }
    ]
  }
]

Source	Link
github	www.github.com/openclaw/openclaw/security/advisories/GHSA-cg7q-fg22-4g98
github	www.github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975c
vulncheck	www.vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-host-execution

27 Apr 2026 23:24Current

5.5Medium risk

Vulners AI Score5.5

CVSS 47.1

CVSS 3.16.5

EPSS0.00054