What’s Vulnerable › Vulnerabilities

CVE-2026-35650: OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-10 · updated 2026-06-17
• Weakness: CWE-15

Description

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary code with unintended environment variables.

Affected products

• OpenClaw: before 2026.3.22 — fixed in 2026.3.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.22. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
• https://github.com/openclaw/openclaw/commit/7abfff756d6c68d17e21d1657bbacbaec86de232
• https://github.com/openclaw/openclaw/security/advisories/GHSA-39pp-xp36-q6mg
• https://www.vulncheck.com/advisories/openclaw-environment-variable-override-bypass-via-inconsistent-sanitization

Get alerted when CVE-2026-35650 or the next vulnerability affects your stack