CVE-2026-44114: Openclaw

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.

Affected products

• Openclaw Openclaw: before 2026.4.20 (fixed in 2026.4.20)

Published 2026-05-06. Last modified 2026-06-17.