OpenClaw .env Vulnerability: Local File Can Hijack Config

The National Vulnerability Database has disclosed CVE-2026-41294, a high-severity vulnerability (CVSS 8.6) affecting OpenClaw before version 2026.3.28. This flaw stems from OpenClaw’s practice of loading .env files from the current working directory before processing trusted state-dir configurations. This creates a critical window for environment variable injection.

Attackers can exploit this by placing a specially crafted .env file within a repository or workspace. When OpenClaw starts up in that directory, the malicious .env file can override critical runtime configurations and security-sensitive environment settings. This effectively allows an attacker to dictate how the application operates, potentially leading to privilege escalation, data exfiltration, or complete system compromise. The vulnerability is tagged as CWE-15, indicating improper handling of environment variables.

Defenders must recognize the implications here: it’s an attack vector tied to project environments. If developers are pulling untrusted repositories or working in shared workspaces, this becomes a significant concern. The fix is straightforward: upgrade OpenClaw to version 2026.3.28 or later immediately to ensure trusted configurations are prioritized.