CVE-2026-45003 - OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files

Back Back to CVE browser

MEDIUM

OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files

Published May 11, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.15%

Description

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.4.22
- Version
  2026.4.22
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenClaw

unaffected

Version	Status	Constraints
0	affected	<2026.4.22
2026.4.22	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.4.22

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-427

CWE-441

CWE-610

References (5)

https://github.com/advisories/GHSA-55cf-xx38-4p9p
Advisory
https://github.com/openclaw/openclaw/commit/0623079e98abf7202591f1b04a89755eb7ec9272
patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-55cf-xx38-4p9p
vendor-advisoryThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-45003
https://www.vulncheck.com/advisories/openclaw-connector-endpoint-host-override-via-workspace-dotenv-files
third-party-advisoryPatchThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-55cf-xx38-4p9p		Advisory
https://github.com/openclaw/openclaw/commit/0623079e98abf7202591f1b04a89755eb7ec9272		patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-55cf-xx38-4p9p		vendor-advisoryThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-45003
https://www.vulncheck.com/advisories/openclaw-connector-endpoint-host-override-via-workspace-dotenv-files		third-party-advisoryPatchThird Party Advisory