Skip to content
CVE PROGRAM SOURCE RECORD4.1 Medium

CVE-2026-45003

OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.4.22affected
  • 2026.4.22unaffected
pkg:npm/openclaw

References