External Control of System or Configuration Setting in OpenClaw - #VU132744
Published: May 29, 2026
Vulnerability identifier: #VU132744
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-15
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to load bundled runtime dependencies from an unintended local state path.
The vulnerability exists due to improper control of environment variables in runtime dependency root resolution when opening a repository containing a crafted workspace .env file. A remote user can supply a workspace .env that sets STATE_DIRECTORY to load bundled runtime dependencies from an unintended local state path.
Exploitation requires the affected feature to be enabled and reachable.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.2