https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:29:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44992 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.</p> https://cve.radiocsirt.org/vuln/cve-2026-44992 https://cve.radiocsirt.org/vuln/ghsa-h2vw-ph2c-jvwf <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&gt;= 2026.4.5, &lt; 2026.4.20` - Patched version: `2026.4.20`</p> <p>## Impact</p> <p>A malicious workspace `.env` could set `MINIMAX_API_HOST` and redirect credentialed MiniMax requests to an attacker-controlled origin, exposing the MiniMax API key in the outbound `Authorization` header.</p> <p>This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.</p> <p>## Fix</p> <p>OpenClaw now blocks `MINIMAX_API_HOST` from workspace dotenv injection and removes env-driven URL routing from the affected MiniMax request path.</p> <p>Fix commit:</p> <p>- `2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1`</p> <p>## Release</p> <p>Fixed in OpenClaw `2026.4.20`.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&gt;= 2026.4.5, &lt; 2026.4.20` - Patched version: `2026.4.20`</p> <p>## Impact</p> <p>A malicious workspace `.env` could set `MINIMAX_API_HOST` and redirect credentialed MiniMax requests to an attacker-controlled origin, exposing the MiniMax API key in the outbound `Authorization` header.</p> <p>This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.</p> <p>## Fix</p> <p>OpenClaw now blocks `MINIMAX_API_HOST` from workspace dotenv injection and removes env-driven URL routing from the affected MiniMax request path.</p> <p>Fix commit:</p> <p>- `2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1`</p> <p>## Release</p> <p>Fixed in OpenClaw `2026.4.20`.</p> https://cve.radiocsirt.org/vuln/ghsa-h2vw-ph2c-jvwf