CVE-2026-41357: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41357 is an environment variable leakage vulnerability in OpenClaw's SSH-based sandbox backends, where unsanitized process.env is passed to child processes. Affecting OpenClaw versions up to and including 2026.3.28 (npm package), it was disclosed on April 23–24, 2026, with a fix available in version 2026.3.31. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 2.0 (Low) (Github Advisory, OpenClaw Advisory).

The root cause is classified as CWE-214 (Invocation of Process Using Visible Sensitive Information): the SSH sandbox backend code directly passed the full process.env object — including sensitive variables such as OPENAI_API_KEY and ANTHROPIC_API_KEY — to spawned SSH child processes without filtering. Exploitation requires a local attacker with low privileges and a non-default SSH environment forwarding configuration to be present (Attack Requirements: Present), which limits the practical attack surface. The fix introduced a sanitizeEnvVars() function that filters blocked secrets before passing the environment to SSH subprocesses, replacing direct process.env references in ssh-backend.ts and openshell/src/backend.ts (OpenClaw Commit, OpenClaw Advisory).

Successful exploitation allows a low-privileged local attacker to read sensitive environment variables — such as API keys and tokens (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) — from the parent OpenClaw process via SSH child processes. There is no impact on integrity or availability; the scope is limited to confidentiality of the vulnerable system. Leaked credentials could potentially enable further unauthorized access to external services or APIs if the attacker can leverage the exposed secrets (Github Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011–0.014%, placing it in the low percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, low privileges, and a non-default SSH environment forwarding configuration, significantly limiting the practical attack surface (Github Advisory, OpenClaw Advisory).

1. Prerequisite: Obtain low-privileged local access to a system running OpenClaw ≤2026.3.28 with SSH-based sandbox backends enabled.
2. Identify SSH environment forwarding: Confirm that the SSH server or client configuration has environment forwarding enabled (non-default setting, e.g., AcceptEnv or SendEnv directives in SSH config).
3. Trigger SSH sandbox execution: Cause OpenClaw to spawn an SSH child process via its sandbox backend (e.g., by initiating a sandboxed command execution that uses the SSH backend path).
4. Capture forwarded environment: On the SSH child process side, read the forwarded environment variables (e.g., via /proc/<pid>/environ on Linux or by inspecting the process environment) to extract sensitive values such as OPENAI_API_KEY or ANTHROPIC_API_KEY that were leaked from the parent process (OpenClaw Advisory, OpenClaw Commit).

• Process: Unexpected reading of /proc/<pid>/environ for OpenClaw parent processes by low-privileged users; unusual enumeration of environment variables associated with OpenClaw SSH child processes.
• Logs: SSH access logs showing connections with environment variable forwarding enabled (AcceptEnv/SendEnv) from local users interacting with OpenClaw sandbox sessions.
• Network: SSH sessions initiated by OpenClaw sandbox backends where environment forwarding is active and not expected by policy.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which introduces the sanitizeEnvVars() function to filter sensitive environment variables before passing them to SSH child processes (OpenClaw Commit). As a workaround, restrict SSH environment forwarding by removing or limiting AcceptEnv/SendEnv directives in SSH server and client configurations to prevent environment variable propagation. Apply the principle of least privilege to processes running OpenClaw and audit which environment variables are set in the OpenClaw process context (OpenClaw Advisory).

The vulnerability was reported by security researcher AntAISecurityLab and acknowledged by the OpenClaw maintainer (steipete), who assessed it as narrow in scope and low severity due to the non-default SSH environment forwarding requirement. No significant broader media coverage or notable community discussion has been identified beyond the GitHub advisory and standard vulnerability database entries (OpenClaw Advisory).