Most recent entries from all

BREW-openclaw-cli-CVE-2026-41330 — OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

Affected: Homebrew: openclaw-cli

## Summary Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

## Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `4d912e04519b4bd53b248437c53748cdebce9a41` — 2026-03-31T21:25:36+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

EUVD-2026-292199

fkie_cve-2026-41330

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

GHSA-9gp8-hjxr-6f34 — OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

Affected: npm: openclaw

## Summary Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

## Fix Commit(s) - `4d912e04519b4bd53b248437c53748cdebce9a41` — 2026-03-31T21:25:36+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.