Executive brief
OpenClaw is a popular development tool that loads environment configuration from workspace files. A flaw allows attackers to override critical runtime control variables by crafting malicious workspace configuration files, potentially manipulating how OpenClaw handles source updates and installer operations. This requires running OpenClaw in an attacker-controlled workspace directory.
Technical details
OpenClaw fails to properly reserve the OPENCLAW_ runtime-control environment variable namespace when loading workspace dotenv files (CWE-184: Incomplete List of Disallowed Inputs). An attacker can craft a malicious workspace containing a .env file that sets variables like OPENCLAW_GIT_DIR, which are then used by OpenClaw's source-update and installer flows without sufficient validation. The attack requires local access and the victim must run OpenClaw from within the attacker-controlled workspace directory. The vulnerability is fixed in version 2026.4.20, which now rejects workspace dotenv entries for OpenClaw runtime-control variables and properly reserves the OPENCLAW_ namespace.
Affected products
- OpenClaw OpenClaw before 2026.4.20
Timeline
- 2026-04-21: disclosed
- 2026-04-21: patched: Fixed in version 2026.4.20