CVE-2026-41357
CVE-2026-41357 · OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.
CVSS 2.0 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j9pv-rrcj-6pfx
- https://github.com/openclaw/openclaw/commit/cfe14459531e002a1c61c27d97ec7dc8aecddc1f
- https://www.vulncheck.com/advisories/openclaw-unsanitized-environment-variable-leakage-in-ssh-sandbox-backends
- https://nvd.nist.gov/vuln/detail/CVE-2026-41357