CVE-2026-41387
Openclaw ≤ 2026.3.22
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-41387 is a high-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41387 is an incomplete host environment variable sanitization vulnerability affecting OpenClaw versions before 2026.3.22. The issue resides in the files host-env-security-policy.json and host-env-security.ts, which fail to properly prevent package-manager environment overrides. Published on 2026-04-28, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-183.
A local attacker can exploit the vulnerability through approved exec requests, redirecting package resolution or runtime bootstrap processes to attacker-controlled infrastructure. This enables the execution of trojanized content, potentially compromising confidentiality, integrity, and availability with high impact. Exploitation requires user interaction but no special privileges.
Mitigation guidance is provided in the official OpenClaw security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-supply-chain-redirection-via-incomplete-host-environment-sanitization. Upgrading to OpenClaw 2026.3.22 or later addresses the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26096
Vulnerability Data
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V4.4.2
Mitigating Controls (NIST 800-53 r5) AI
Strict validity checks on inputs directly stop overly permissive allow lists from being used as the protection mechanism.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.
Secure system architecture and engineering principles require explicit, least-privilege input validation designs that directly address permissive allow-lists.
Secure coding standards enforce rigorous input validation and reject unsafe values, mitigating permissive allow-list weaknesses.
Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.