Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary code with unintended environment variables.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35650 OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through … https://www.cve.org/CVERecord?id=CVE-2026-35650
Post summary
The text announces a disclosure of CVE-2026-35650, noting an environment variable override flaw in OpenClaw that lets attackers bypass shared host environment policy.
New on http://subagentic.ai: Microsoft assembles an engineering team to integrate OpenClaw into M365 Copilot ahead of Build 2026. Also: CVE-2026-35650 discloses an environment variable override bypass in OpenClaw pre-2026.3.22. https://subagentic.ai
Post summary
The post announces CVE-2026-35650, revealing an environment variable override bypass in OpenClaw versions prior to 2026.3.22, without providing exploit details or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |