CVE-2026-35650: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35650 is an environment variable override handling vulnerability in OpenClaw (npm package) that allows low-privileged network attackers to bypass the shared host environment security policy through inconsistent sanitization paths. Affected versions are all releases of the openclaw npm package prior to 2026.3.22. The vulnerability was disclosed via a GitHub Security Advisory (GHSA-39pp-xp36-q6mg) published March 24, 2026, and assigned a CVE on April 10, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-15 (External Control of System or Configuration Setting) and CWE-693 (Protection Mechanism Failure). The gateway host exec environment override handling in OpenClaw did not consistently apply the shared host environment policy across all code paths: src/agents/bash-tools.exec.ts and src/node-host/invoke-system-run.ts each implemented their own validation logic rather than routing through a single shared sanitizer, allowing blocked or malformed override keys (e.g., CLASSPATH, GEM_HOME, keys with non-portable characters) to slip through inconsistent validation and be passed to executed processes. An authenticated, low-privileged attacker with network access can supply crafted environment variable override keys in exec/run requests to inject blocked variables — such as CLASSPATH, CORECLR_PROFILER_PATH, or LD_PRELOAD-family prefixes — into host command execution contexts, effectively subverting the security boundary (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary code with unintended environment variables on the host system, bypassing the shared host environment security policy. The impact spans all three security dimensions: high confidentiality impact (access to sensitive host data), high integrity impact (ability to alter execution behavior via injected environment variables), and high availability impact (potential to disrupt or crash host processes). Because the vulnerability affects the gateway and node host execution paths, exploitation could enable lateral movement within shared hosting environments or compromise the integrity of agent-executed commands (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires low privileges (authenticated access) and no user interaction, making it relatively accessible to any user with API or agent access to a vulnerable OpenClaw instance. The EPSS score is approximately 0.06%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a vulnerable instance: Confirm the target is running an openclaw npm package version prior to 2026.3.22, accessible over the network with at least low-privileged (authenticated) access.
2. Obtain credentials: Authenticate to the OpenClaw gateway or node host using any valid low-privileged account or API token.
3. Craft a malicious exec/run request: Construct an agent exec or system run request that includes environment variable overrides with blocked keys (e.g., CLASSPATH, GEM_HOME, CORECLR_PROFILER_PATH) or malformed/non-portable key names that bypass the inconsistent validation logic in bash-tools.exec.ts or invoke-system-run.ts.
4. Submit the request: Send the crafted request to the gateway or node host exec endpoint. On vulnerable versions, the inconsistent sanitization paths fail to reject the blocked or malformed keys, allowing them to be merged into the execution environment.
5. Achieve code execution with injected environment: The target process executes with the attacker-controlled environment variables active, enabling behaviors such as loading attacker-controlled JARs via CLASSPATH, redirecting Ruby gem paths via GEM_HOME, or influencing interpreter behavior via other blocked variables (GitHub Advisory, Fix Commit).

• Logs: OpenClaw gateway or node host logs showing exec/run requests with environment override keys matching blocked variables (e.g., CLASSPATH, GEM_HOME, GEM_PATH, CORECLR_PROFILER_PATH, PHPRC, DENO_DIR, BUN_CONFIG_REGISTRY, LUA_PATH, LUA_CPATH, BUNDLE_GEMFILE, COMPOSER_HOME, XDG_CONFIG_HOME, CGO_CFLAGS, CGO_LDFLAGS, GOFLAGS) or non-portable key names (containing hyphens, spaces, or other non-alphanumeric/underscore characters).
• Process: Host processes spawned by OpenClaw agents exhibiting unexpected runtime behavior attributable to injected environment variables (e.g., Java processes loading unexpected classpaths, Ruby processes using non-standard gem directories).
• Network: Authenticated API requests to OpenClaw exec/run endpoints containing env parameters with suspicious or blocked key names, particularly from accounts not expected to submit exec requests with environment overrides.

The fix is available in OpenClaw version 2026.3.22 and later (including 2026.3.23 and 2026.3.23-2). The patch introduces a single shared sanitizer in src/infra/host-env-security.ts with fail-closed diagnostics, and routes all environment overrides through this shared sanitizer in both src/agents/bash-tools.exec.ts and src/node-host/invoke-system-run.ts before execution. Operators should immediately upgrade the openclaw npm package to >= 2026.3.22. As a temporary workaround prior to patching, restrict network access to OpenClaw instances and limit which accounts can submit exec/run requests with environment overrides (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher @zpbrent and credited in the GitHub Security Advisory. The fix was authored by @joshavant and @gladiator9797 as part of PR #51207. No significant broader media coverage or notable public researcher commentary beyond the advisory and automated CVE tracking sites has been identified (GitHub Advisory).