CVE-2026-34426 — OpenClaw - Approval Bypass via Environment Variable Normalization
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, a…
Published: 2026-04-02 · CVSS: 6.9 · CVSS 4.0
OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7