Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Openclaw (CLI Backend), Environment Variable Injection, #CVE-2026-4039 (High) https://dailycve.com/openclaw-cli-backend-environment-variable-injection-cve-2026-4039-high/
Post summary
The post announces the discovery of a high‑severity environment variable injection vulnerability (CVE‑2026‑4039) in Openclaw’s CLI backend.
CVE-2026-4039 A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executi… https://www.cve.org/CVERecord?id=CVE-2026-4039
Post summary
A vulnerability (CVE-2026-4039) affecting OpenClaw 2026.2.19-2’s Skill Env Handler is disclosed, with technical details but no PoC, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |