OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes.
Date: 2026-04
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-41296
CVE-2026-41300
CVE-2026-41302
CVE-2026-41329
CVE-2026-41330
CVE-2026-41331
CVE-2026-41333
CVE-2026-41334
CVE-2026-41335
CVE-2026-41336
CVE-2026-41337
CVE-2026-41338
CVE-2026-41340
CVE-2026-41341
CVE-2026-41343
CVE-2026-41345
CVE-2026-41347
CVE-2026-41348
CVE-2026-41351
CVE-2026-41352
CVE-2026-41355
CVE-2026-41356
CVE-2026-41357
CVE-2026-41362
CVE-2026-41364
CVE-2026-41365
CVE-2026-41369
CVE-2026-41370
CVE-2026-41373
CVE-2026-41374
CVE-2026-41376
CVE-2026-41378
CVE-2026-41381
CVE-2026-41382
CVE-2026-41385
CVE-2026-41388
CVE-2026-41391
CVE-2026-41393
CVE-2026-41396
CVE-2026-41397
CVE-2026-41400
CVE-2026-41402
CVE-2026-41403
CVE-2026-41404
CVE-2026-41405
CVE-2026-41406
CWE: CWE-184
CWE-212
CWE-214
CWE-22
CWE-287
CWE-294
CWE-312
CWE-346
CWE-351
CWE-352
CWE-367
CWE-372
CWE-408
CWE-427
CWE-441
CWE-453
CWE-497
CWE-522
CWE-59
CWE-613
CWE-636
CWE-639
CWE-648
CWE-668
CWE-706
CWE-732
CWE-770
CWE-799
CWE-807
CWE-829
CWE-862
CWE-863
CWE-918
CVSS: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.


Mitigations:

Architectural layers (MAESTRO):