CVE-2026-44114: OpenClaw: Workspace dotenv could override runtime-control environment variables
(updated )
Workspace .env loading did not reserve the OPENCLAW_ runtime-control namespace broadly enough. A malicious workspace could set variables such as OPENCLAW_GIT_DIR before source-update or installer flows, potentially steering trusted OpenClaw runtime behavior.
This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.
References
- github.com/advisories/GHSA-hxvm-xjvf-93f3
- github.com/openclaw/openclaw/commit/018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6
- github.com/openclaw/openclaw/security/advisories/GHSA-hxvm-xjvf-93f3
- nvd.nist.gov/vuln/detail/CVE-2026-44114
- www.vulncheck.com/advisories/openclaw-environment-variable-namespace-collision-via-workspace-dotenv
Code Behaviors & Features
Detect and mitigate CVE-2026-44114 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →