CVE-2026-41396
highOpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification.
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.
CVSS
7.8
7.8 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-04-28 19:37
Modified: 2026-11-11 21:10
NVD status: Analyzed
Last synced 5 hours ago
Verified against the source API 2026-11-11 21:11 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.3.31
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trus... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 21:11 UTC · record ↗