CVE-2026-44992: Openclaw

Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

Affected products

• Openclaw Openclaw: from 2026.4.5, before 2026.4.20 (fixed in 2026.4.20)

Published 2026-05-11. Last modified 2026-06-17.