← Back

CVE-2026-35650

nvd nist
Published: Apr 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.7
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary code with unintended environment variables.

Affected (1)

Products: Openclaw: Openclaw
Openclaw
1 product
Openclaw
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openclaw
Before 2026.3.22

Related CWEs

CWE-15
External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user.

References (4)

Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Vendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.