Executive brief
OpenClaw is an AI automation tool that integrates with third-party services like MiniMax. A flaw in versions 2026.4.5–2026.4.19 allows attackers who control a workspace's .env configuration file to redirect API requests to attacker-controlled servers, stealing the MiniMax API credentials. This requires the victim to run OpenClaw from a malicious workspace but could lead to complete compromise of MiniMax API access and associated data.
Technical details
The vulnerability is an environment variable injection (CWE-441, Unintended Proxy/Confused Deputy) in OpenClaw's workspace .env handling. The root cause is that workspace dotenv files are permitted to override the MINIMAX_API_HOST variable, which controls where MiniMax API requests are routed. An attacker can place a malicious .env file in a workspace to set MINIMAX_API_HOST to an attacker-controlled domain. When OpenClaw makes credentialed requests to MiniMax, those requests are instead sent to the attacker's server, exposing the API key in the Authorization header. The attack requires the victim to run OpenClaw from an attacker-supplied or compromised workspace. OpenClaw 2026.4.20 and later block MINIMAX_API_HOST from workspace .env injection and remove env-driven URL routing from the affected code path, fixing the vulnerability.
Affected products
- OpenClaw OpenClaw 2026.4.5 to 2026.4.19
Timeline
- 2026-04-21: disclosed: GitHub security advisory GHSA-h2vw-ph2c-jvwf published
- 2026-04-20: patched: Fix committed to block MINIMAX_API_HOST workspace env injection (commit 2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1)
- 2026-05-11: other: Duplicate advisory GHSA-4mhr-cxr4-2prm published and later withdrawn
- 2026-05-18: other: Duplicate advisory GHSA-4mhr-cxr4-2prm withdrawn