OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.
| Vendor | Product | Versions |
|---|---|---|
| OpenClaw | Environment Variable Handler | 0 |
Updated vendor to OpenClaw, product to Environment Variable Handler, severity to CRITICAL, and corrected exploit availability to false.
Initial creation
