AI agent vulnerability · OpenClaw

CVE-2026-44995: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

mediumCVSS 4.0 5.4GHSA-mj59-h3q9-ghfh

Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as NODEOPTIONS, LDPRELOAD, or BASHENV to the spawned MCP server process.

Published Apr 25, 2026 · Updated May 19, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.4.20
Fixed in: 2026.4.20
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to the spawned MCP server process. In a malicious workspace, this could make the MCP child load attacker-controlled code when the operator starts a session that uses that MCP server.

The impact is limited to local/workspace trust boundaries and requires the operator to run OpenClaw in a workspace containing the malicious MCP configuration. Severity is therefore medium, not high/critical.

Fix

OpenClaw now filters MCP stdio environment entries through the host environment safety denylist before spawning stdio MCP servers.

Fix commits:

62fa5071896e95edc7f67d1cebc70a2859e283af
85d86ebc4bf3d2226d39d132a484f4f7a299fa1b

Release

Fixed in OpenClaw 2026.4.20.

Credited to garagon.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries