CVE-2026-41330

OpenClaw versions prior to 2026.3.31 contain an environment variable override vulnerability that allows local attackers with low privileges to bypass critical security controls including proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement. This vulnerability exists in the host exec policy implementation, which fails to properly sanitize or validate environment variables during policy enforcement. The flaw affects multiple security layers that organizations typically rely on to restrict and monitor application behavior. The vulnerability carries a CVSS score of 4.4 (Medium severity) with a local attack vector requiring low privileges and no user interaction, resulting in limited confidentiality and integrity impact. The low EPSS score of 0.00011 indicates this vulnerability is not prevalent among publicly disclosed CVEs, suggesting either limited real-world deployment of affected versions or low attacker interest. The FAUCET risk score of 30.0 out of 100 reflects the moderate operational concern. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. No public exploit code appears to be available, and community attention remains minimal based on the inactive hot list status. Organizations should prioritize patching to version 2026.3.31 or later as part of routine security updates, though this does not represent an immediate critical threat.