Executive brief
OpenClaw is a Model Context Protocol (MCP) framework used for AI assistant integration. A malicious workspace configuration can inject dangerous environment variables (like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV) into MCP server processes, allowing attackers to execute arbitrary code when an operator starts a session. The vulnerability requires the operator to use a workspace containing the malicious configuration.
Technical details
The vulnerability is an improper environment variable validation issue (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) in OpenClaw's MCP stdio server configuration. Workspace configuration files can pass dangerous process startup environment variables to spawned MCP server processes without filtering. An attacker with control over workspace configuration can leverage variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to load arbitrary code when the MCP server is spawned. The attack requires local access and operator interaction (starting a session with the malicious MCP server). The fix, released in version 2026.4.20, implements a safety denylist to filter dangerous environment variables before spawning stdio MCP servers.
Affected products
- OpenClaw OpenClaw before 2026.4.20
Timeline
- 2026-04-21: disclosed: Original advisory published
- 2026-04-20: patched: Fixed in version 2026.4.20
- 2026-05-11: other: Duplicate advisory GHSA-p3m6-jr2h-hhxj published
- 2026-05-18: other: Duplicate advisory withdrawn