CVE-2026-53842: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

June 18, 2026

Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDK_PYTHON.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw’s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

References

github.com/advisories/GHSA-fq9j-vw4w-fr6v
github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v
nvd.nist.gov/vuln/detail/CVE-2026-53842
www.vulncheck.com/advisories/openclaw-arbitrary-python-runtime-execution-via-cloudsdk-python-environment-variable

Code Behaviors & Features

Detect and mitigate CVE-2026-53842 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →