CVE-2026-22177: OpenClaw: env var injection via config enables code execution

MEDIUM

Published March 18, 2026

CISO Take

OpenClaw versions before 2026.2.21 do not filter dangerous process-control environment variables such as NODE_OPTIONS or LD_* when loading config env.vars. An attacker who can write to the configuration can therefore get arbitrary code to run when the gateway service starts. Exploitation needs local access and low privileges, and the CVSS score is 6.1 (medium). There is no CISA KEV listing, no public exploit and no Nuclei template, and EPSS data is unavailable, so near-term mass exploitation looks unlikely. The package has only 3 downstream dependents, but the gateway often holds agent credentials and tool access, so any config-write foothold can become code execution in that context. Upgrade to 2026.2.21 or later, and restrict who and what can write OpenClaw configuration files in the meantime.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium overall. The attack is local with low complexity, low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N). The main impact is high integrity loss plus some availability impact, and confidentiality impact is not scored. Exposure depends on who can modify the gateway config: shared hosts, CI/CD-managed configs, mounted volumes and config-sync mechanisms raise the risk. Exploitation signals are weak: not in CISA KEV, no public exploit, no Nuclei template, and no EPSS or SSVC data. Real-world risk rises if the gateway runs with broad credentials or tool permissions, because injected code inherits that runtime context.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged local access or a config-write path to the OpenClaw gateway host.

AML.T0081

Configuration Tampering

Dangerous variables such as NODE_OPTIONS or LD_PRELOAD are added to config env.vars and are not filtered.

AML.T0081

Execution

On gateway startup the injected variables load attacker code into the service process.

AML.T0050

Impact

Attacker tampers with the agent runtime, steals credentials and tool access, and persists across restarts.

Initial Access

Attacker obtains low-privileged local access or a config-write path to the OpenClaw gateway host.

AML.T0081

Configuration Tampering

Dangerous variables such as NODE_OPTIONS or LD_PRELOAD are added to config env.vars and are not filtered.

AML.T0081

Execution

On gateway startup the injected variables load attacker code into the service process.

AML.T0050

Impact

Attacker tampers with the agent runtime, steals credentials and tool access, and persists across restarts.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~7d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ALow

What should I do?

1 step

1) Upgrade OpenClaw to 2026.2.21 or later; the fix is in the vendor commit 2cdbadee1f8fcaa93302d7debbfc529e19868ea4 referenced in the GHSA advisories. 2) Restrict write access to OpenClaw config files and directories to the service owner and administrators, and keep them out of shared or world-writable mounts. 3) Audit existing config env.vars for NODE_OPTIONS, NODE_PATH, LD_PRELOAD, LD_LIBRARY_PATH and similar process-control variables, and treat unexpected entries as a possible compromise. 4) Run the gateway as a least-privilege user with scoped credentials and, where possible, in a container or sandbox with a read-only config. 5) Monitor config file integrity and alert on changes or on unusual child processes spawned at gateway start. 6) Rotate secrets available to the gateway if tampering is found.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAgentFrameworkAML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-22177?

Is CVE-2026-22177 actively exploited?

No confirmed active exploitation of CVE-2026-22177 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22177?

1) Upgrade OpenClaw to 2026.2.21 or later; the fix is in the vendor commit 2cdbadee1f8fcaa93302d7debbfc529e19868ea4 referenced in the GHSA advisories. 2) Restrict write access to OpenClaw config files and directories to the service owner and administrators, and keep them out of shared or world-writable mounts. 3) Audit existing config env.vars for NODE_OPTIONS, NODE_PATH, LD_PRELOAD, LD_LIBRARY_PATH and similar process-control variables, and treat unexpected entries as a possible compromise. 4) Run the gateway as a least-privilege user with scoped credentials and, where possible, in a container or sandbox with a read-only config. 5) Monitor config file integrity and alert on changes or on unusual child processes spawned at gateway start. 6) Rotate secrets available to the gateway if tampering is found.

What systems are affected by CVE-2026-22177?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent gateway services, local/self-hosted AI assistants.

What is the CVSS score for CVE-2026-22177?

CVE-2026-22177 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent gateway serviceslocal/self-hosted AI assistants

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.

Exploitation Scenario

An attacker with low-privileged local access, for example a compromised build job, a shared developer host or a malicious plugin that can write files, edits the OpenClaw configuration to add env.vars entries such as NODE_OPTIONS=--require /tmp/payload.js. When the gateway restarts, whether on a routine redeploy or after a forced crash, the payload runs inside the gateway process before any agent controls apply. The attacker then reads provider API keys and connected-service tokens, and installs persistence that survives restarts through the same config.

Weaknesses (CWE)

CWE-15External Control of System or Configuration Setting

CWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Source: MITRE CWE corpus.