A vulnerability in OpenClaw allows authenticated attackers to bypass security policies and execute arbitrary code by manipulating environment variables.

The software fails to properly sanitize environment variable overrides, allowing an authenticated attacker with low privileges to supply malformed keys that bypass host environment policies. This flaw enables the execution of arbitrary code through the injection of unintended environment variables.

The ability to execute arbitrary code poses a severe risk to the integrity and confidentiality of the host system. Given the CVSS score of 7.5, this high-severity vulnerability could lead to unauthorized system control or lateral movement within the network. Organizations relying on OpenClaw for environment management should prioritize remediation to prevent potential system compromise.

Immediate Action: Update the OpenClaw package to version 2026.3.22 or later to apply the necessary sanitization fixes.

Proactive Monitoring: Review system and application logs for unusual environment variable configurations or repeated failed attempts to access restricted configuration settings.

Compensating Controls: Implement strict network segmentation and restrict access to the application to only authorized users to limit the potential for exploitation by malicious actors.

Public Exploit Available: Unknown

This vulnerability represents a significant security gap that could allow attackers to manipulate system environments for malicious execution. It is essential for administrators to update to version 2026.3.22 immediately to ensure proper sanitization of configuration inputs. Following the update, security teams should verify that all instances are running the patched version and monitor for any anomalous behavior related to environment variable access.