CVE-2026-41396

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada openclaw. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8 advisory vendor
• https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289 patch
• https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root advisory pihak ketiga