OpenClaw Environment Variable Namespace Collision Vulnerability

A vulnerability exists in OpenClaw versions prior to 2026.4.20, where the application fails to properly secure the OPENCLAW_ runtime-control environment namespace in workspace dotenv files. This oversight allows attackers to override important runtime variables. Malicious workspaces could manipulate variables such as OPENCLAW_GIT_DIR, potentially altering trusted OpenClaw runtime behavior during source-update or installation processes.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of OpenClaw's runtime behavior, particularly during critical update or installation phases.

Remediation

Users can update to OpenClaw version 2026.4.20 or later, where this vulnerability has been addressed.