CVE-2026-41396 - OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root

Back Back to CVE browser

HIGH

OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root

Published Apr 28, 2026

8.5

HIGH

CVSS 4.0

EPSS 0.19%

Description

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.3.31
- Version
  2026.3.31
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenClaw

unaffected

Version	Status	Constraints
0	affected	<2026.3.31
2026.3.31	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.3.31

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-15

CWE-829

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26104
Advisory
https://github.com/advisories/GHSA-qcj9-wwgw-6gm8
Advisory
https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289
patch
https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41396
https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26104		Advisory
https://github.com/advisories/GHSA-qcj9-wwgw-6gm8		Advisory
https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289		patch
https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41396
https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root		third-party-advisoryThird Party Advisory