Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41396 Environment Variable Override Enables Malicious Plugin Injection in OpenClaw Before 2026.3.31 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41396
Post summary
The text announces CVE‑2026‑41396, a vulnerability in OpenClaw that allows malicious plugin injection via an environment variable override on versions older than 2026.3.31, without mentioning PoC, exploitation, or remediation.
CVE-2026-41396 OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attac… https://www.cve.org/CVERecord?id=CVE-2026-41396
Post summary
The CVE-2026-41396 vulnerability allows .env files to override an environment variable in OpenClaw, bypassing plugin trust verification.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |