OpenClaw Vulnerability: Arbitrary Code Execution via .env File Override

The National Vulnerability Database has disclosed CVE-2026-41336, a high-severity vulnerability affecting OpenClaw prior to version 2026.3.31. This flaw allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, a critical mechanism for maintaining code integrity.

This override capability is a significant problem. Attackers can leverage it to replace legitimate, default-on bundled hooks with their own malicious code. By tricking users into opening an untrusted workspace, an attacker can achieve arbitrary code execution, effectively taking control of the system. The CVSS score of 7.8 (HIGH) underscores the severe impact on confidentiality, integrity, and availability.

This isn’t just a configuration oversight; it’s a direct path to system compromise. Defenders need to recognize that seemingly innocuous configuration files can become potent attack vectors when they can manipulate execution paths. The attacker’s calculus here is simple: target developer environments where OpenClaw is used, knowing that a compromised workspace can yield high-value access.