CVE-2026-35650: OpenClaw env var override bypass

CISO Take

CVE-2026-35650 is an environment variable override handling flaw in OpenClaw, an AI agent framework, that allows low-privileged network-authenticated attackers to bypass the platform's shared host environment policy by supplying malformed or blocked override keys that slip through inconsistent sanitization logic (CWE-15), enabling arbitrary code execution with unintended environment variables. With a CVSS score of 7.5 and full confidentiality, integrity, and availability impact, this is especially concerning for teams running OpenClaw agents on shared infrastructure where compromised environment variables can expose LLM API keys, model credentials, and pipeline secrets injected at runtime. The real-world incident record (AIID #1368) confirms active threat actor interest in subverting OpenClaw's security controls — malicious skills in its ecosystem were already observed delivering credential stealers, establishing a precedent for this attack surface. Organizations should upgrade to OpenClaw 2026.3.22 or later immediately; if patching is delayed, restrict network access to OpenClaw endpoints and audit all deployed agents for unauthorized environment variable overrides.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

High-severity (CVSS 7.5) with a network attack vector and low privilege requirement. High attack complexity (AC:H) moderates near-term exploitation likelihood, but once the inconsistent sanitization bypass path is understood, the technique is repeatable with low friction. AI agent runtimes are high-value targets because they typically hold LLM API keys, file-system access, and tool credentials in their runtime environment — exactly the attack surface this vulnerability exposes. The 396 other CVEs in the same package signal a historically vulnerability-prone codebase. Without CISA KEV listing or public exploit code, organizations running patched versions face moderate residual risk; unpatched deployments on shared-host infrastructure are at significant and immediate risk.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privileged account to OpenClaw's network-facing API endpoint, gaining a minimal foothold within the platform.

AML.T0049

Policy Bypass

Attacker crafts malformed environment variable override keys that exploit inconsistent sanitization paths (CWE-15) to slip blocked values past validation and inject arbitrary env vars into the agent runtime.

AML.T0107

Configuration Manipulation

Injected environment variables override legitimate agent configuration values — LLM API keys, tool binary paths, or shell execution hooks — redirecting agent behavior toward attacker-controlled infrastructure.

AML.T0081

Code Execution & Impact

Agent executes subsequent tasks under the poisoned environment, enabling arbitrary code execution, credential exfiltration, and potential lateral movement to co-hosted agents or the underlying host.

AML.T0105

Initial Access

Attacker authenticates with a low-privileged account to OpenClaw's network-facing API endpoint, gaining a minimal foothold within the platform.

AML.T0049

Policy Bypass

Attacker crafts malformed environment variable override keys that exploit inconsistent sanitization paths (CWE-15) to slip blocked values past validation and inject arbitrary env vars into the agent runtime.

AML.T0107

Configuration Manipulation

Injected environment variables override legitimate agent configuration values — LLM API keys, tool binary paths, or shell execution hooks — redirecting agent behavior toward attacker-controlled infrastructure.

AML.T0081

Code Execution & Impact

Agent executes subsequent tasks under the poisoned environment, enabling arbitrary code execution, credential exfiltration, and potential lateral movement to co-hosted agents or the underlying host.

AML.T0105

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately: Upgrade OpenClaw to version 2026.3.22 or later. Both patch commits (630f147, 7abfff7) are publicly available. Reference: GHSA-39pp-xp36-q6mg and VulnCheck advisory.
Network restriction: If immediate patching is not feasible, restrict access to OpenClaw API endpoints to trusted IP ranges and enforce least-privilege authentication for all service accounts.
Environment hardening: Migrate sensitive credentials out of environment variables into a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, or equivalent) to limit blast radius if override is achieved.
Detection: Monitor deployed OpenClaw agent processes for unexpected environment variable changes and anomalous outbound connections from agent execution contexts. Audit logs for requests containing non-standard or malformed override key patterns.
Dependency review: Identify and assess transitive exposure across the 4 known downstream dependents of OpenClaw before declaring the environment clean.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system deployment and operation

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to respond to, recover from, and communicate about AI risks

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35650?

CVE-2026-35650 is an environment variable override handling flaw in OpenClaw, an AI agent framework, that allows low-privileged network-authenticated attackers to bypass the platform's shared host environment policy by supplying malformed or blocked override keys that slip through inconsistent sanitization logic (CWE-15), enabling arbitrary code execution with unintended environment variables. With a CVSS score of 7.5 and full confidentiality, integrity, and availability impact, this is especially concerning for teams running OpenClaw agents on shared infrastructure where compromised environment variables can expose LLM API keys, model credentials, and pipeline secrets injected at runtime. The real-world incident record (AIID #1368) confirms active threat actor interest in subverting OpenClaw's security controls — malicious skills in its ecosystem were already observed delivering credential stealers, establishing a precedent for this attack surface. Organizations should upgrade to OpenClaw 2026.3.22 or later immediately; if patching is delayed, restrict network access to OpenClaw endpoints and audit all deployed agents for unauthorized environment variable overrides.

Is CVE-2026-35650 actively exploited?

No confirmed active exploitation of CVE-2026-35650 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35650?

1. Patch immediately: Upgrade OpenClaw to version 2026.3.22 or later. Both patch commits (630f147, 7abfff7) are publicly available. Reference: GHSA-39pp-xp36-q6mg and VulnCheck advisory. 2. Network restriction: If immediate patching is not feasible, restrict access to OpenClaw API endpoints to trusted IP ranges and enforce least-privilege authentication for all service accounts. 3. Environment hardening: Migrate sensitive credentials out of environment variables into a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, or equivalent) to limit blast radius if override is achieved. 4. Detection: Monitor deployed OpenClaw agent processes for unexpected environment variable changes and anomalous outbound connections from agent execution contexts. Audit logs for requests containing non-standard or malformed override key patterns. 5. Dependency review: Identify and assess transitive exposure across the 4 known downstream dependents of OpenClaw before declaring the environment clean.

What systems are affected by CVE-2026-35650?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, shared-host AI deployments, LLM API pipelines.

What is the CVSS score for CVE-2026-35650?

CVE-2026-35650 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsshared-host AI deploymentsLLM API pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed override keys that slip through inconsistent validation to execute arbitrary code with unintended environment variables.

Exploitation Scenario

A threat actor with a low-privileged OpenClaw account — such as a free-tier user, a compromised service account, or a malicious third-party skill developer — crafts HTTP requests containing malformed environment variable override keys that are nominally blocked by the host environment policy but exploit gaps in the inconsistent validation path (CWE-15). The malformed keys slip past the sanitization check, injecting values such as a custom OPENAI_API_KEY pointing to an attacker-controlled proxy, a modified tool binary path loading a malicious executable, or a shell hook variable enabling command execution on the next invocation. When the OpenClaw agent processes a subsequent legitimate task request, it runs under the poisoned environment and executes attacker-controlled logic or exfiltrates credentials accessible only within the agent runtime. On shared-host deployments, this may additionally enable lateral movement to co-hosted agent instances or provide a foothold on the underlying container host.

Weaknesses (CWE)

CWE-15 External Control of System or Configuration Setting

CWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Source: MITRE CWE corpus.