Executive brief
OpenClaw is a deployment and execution orchestration platform for infrastructure and machine learning workloads. An attacker with access to approved execution requests can bypass environment variable sanitization to inject malicious configuration files, allowing them to redirect git or AWS CLI tools to execute untrusted code or load attacker-controlled credentials. This impacts systems that rely on OpenClaw to enforce security boundaries between trusted and untrusted workloads.
Technical details
The vulnerability is an incomplete input blocklist (CWE-184) in the host-env security policy. OpenClaw's environment variable sanitization mechanism failed to block GIT_TEMPLATE_DIR and AWS_CONFIG_FILE, which can redirect git and AWS CLI to load attacker-controlled configuration files. An attacker with privileges to submit approved exec requests can exploit this to achieve code execution. The attack requires local access and low privileges; no user interaction is needed. The vulnerability was patched in version 2026.3.28 via commit 6eb82fba3c, which added these environment variables to the host-env blocklist.
Affected products
- OpenClaw OpenClaw before 2026.3.28
Timeline
- 2026-03-29: disclosed
- 2026-03-28: patched: Version 2026.3.28 released with fix
- 2026-04-24: advisory: GHSA-wcm7-94wg-h74h published