CVE-2026-41369 — OpenClaw before 2026.3.31 contains insufficient environment

title: CVE-2026-41369 - OpenClaw Host Exec Environment Variable Override
id: scw-2026-04-28-ai-1
status: experimental
level: high
description: |
  Detects the exploitation of CVE-2026-41369 by identifying processes related to OpenClaw that are launched with suspicious environment variables known to be vulnerable to injection. This includes variables like LD_PRELOAD, PYTHONPATH, NODE_OPTIONS, DOCKER_HOST, and SSLKEYLOGFILE, which can be used to override critical system configurations and execute arbitrary code.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41369/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'OpenClaw'
      CommandLine|contains:
          - 'LD_PRELOAD='
          - 'PYTHONPATH='
          - 'NODE_OPTIONS='
          - 'DOCKER_HOST='
          - 'SSLKEYLOGFILE='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse