Vulnerability · Published Apr 2, 2026 · Assigned by VulnCheck

CVE-2026-34426OpenClaw - Approval Bypass via Environment Variable Normalization

High 7.6

In plain English

A high-severity security flaw in OpenClaw from OpenClaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	openclaw	2026.4.2	GHSA-98ch-45wp-ch47
npm	openclaw	2026.3.22	GHSA-h3x4-hc5v-v2gm

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	0 – before b57b680c0c34de907d57f60c38fb358e82aef8f7

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

References

GitHub Security Advisory (GHSA-h3x4-hc5v-v2gm) vendor-advisory
Patch Commit #1 issue-tracking
https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7 patch
https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization third-party-advisory