Vulnerability Description
OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary code with unintended environment variables.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dPatch
- https://github.com/openclaw/openclaw/commit/7abfff756d6c68d17e21d1657bbacbaec86dPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-39pp-xp36-q6mgVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-environment-variable-override-bypaThird Party Advisory
FAQ
What is CVE-2026-35650?
CVE-2026-35650 is a vulnerability with a CVSS score of 7.5 (HIGH). OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. A...
How severe is CVE-2026-35650?
CVE-2026-35650 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35650?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.