Junglewise Threat Intelligence

OpenClaw code execution via MCP stdio environment variables

Severity: high · CVSS 7.3 · Published 2026-05-11

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a tool used for managing development workspaces and Model Context Protocol (MCP) servers. A vulnerability exists where a malicious workspace configuration can trick the application into loading harmful code when a user starts a session. This could allow an attacker to gain full control over the user's local environment and access sensitive data.

Technical details

OpenClaw versions prior to 2026.4.20 fail to properly validate environment variables in the MCP stdio server configuration. An attacker can provide a malicious workspace configuration that includes dangerous startup variables such as NODE_OPTIONS, LD_PRELOAD, or BASH_ENV. When an operator initiates a session using these servers, the spawned MCP child process inherits these variables, leading to the execution of attacker-controlled code (CWE-829, CWE-427). This requires local access to place the configuration and user interaction to start the session. The issue is resolved in version 2026.4.20 by implementing a safety denylist for environment entries.

Affected products

  • OpenClaw openclaw < 2026.4.20

Timeline

  • 2026-04-21: advisory: Original advisory GHSA-mj59-h3q9-ghfh published
  • 2026-05-11: disclosed: CVE-2026-44995 published
  • 2026-05-18: other: Duplicate advisory GHSA-p3m6-jr2h-hhxj withdrawn

References

Related threats