CVE-2026-41357

Katalog CVE

CVSS 3.3 · Low EPSS 0,16%

Kerentanan Invocation of Process Using Visible Sensitive Information pada openclaw. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-214: Invocation of Process Using Visible Sensitive Information

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-j9pv-rrcj-6pfx advisory vendor
• https://github.com/openclaw/openclaw/commit/cfe14459531e002a1c61c27d97ec7dc8aecddc1f patch
• https://www.vulncheck.com/advisories/openclaw-unsanitized-environment-variable-leakage-in-ssh-sandbox-backends advisory pihak ketiga