Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to spawned MCP server processes, enabling code injection when operators start sessions using those servers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Unpopular opinion: The cybersecurity industry is selling you dashboards. The Workspace Trap: CVE-2026-44995 Turns OpenClaw MCP Configs Into Code Execution
Post summary
The post announces CVE-2026-44995, noting it turns OpenClaw MCP configs into code execution, but offers no additional technical details, PoC, or patch information.
CVE-2026-44995 OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitr… https://www.cve.org/CVERecord?id=CVE-2026-44995
Post summary
An improper environment variable validation vulnerability in OpenClaw’s MCP stdio server configuration (CVE‑2026‑44995) allows arbitrary code execution, but the post provides no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |