CVE-2026-35650

CVE-2026-35650 is an environment variable override handling vulnerability affecting OpenClaw versions prior to 2026.3.22. The flaw stems from inconsistent sanitization of override keys, permitting attackers to supply blocked or malformed inputs that bypass validation controls and execute arbitrary code with unintended environment variables, effectively circumventing shared host environment policies. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network attack vector, high complexity, and low privilege requirements. Successful exploitation could result in high-impact compromise across confidentiality, integrity, and availability. While the EPSS score of 0.0007 indicates relatively low predicted exploitation probability compared to the broader CVE landscape, the vulnerability's potential for arbitrary code execution on shared infrastructure warrants attention. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and demonstrates no active exploitation indicators. The vulnerability remains inactive on industry hot lists, and there is no evidence of publicly available exploit code at this time. Organizations running vulnerable OpenClaw versions should prioritize patching to version 2026.3.22 or later as part of standard patch management procedures.