First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-44992

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	>= 2026.4.5, < 2026.4.20

References

https://github.com/openclaw/openclaw/commit/2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwfThird Party Advisory
https://www.vulncheck.com/advisories/openclaw-minimax-api-host-override-via-workspace-dotenvPatch, Third Party Advisory

Timeline

Published: May 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-449935.4OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages CVE-2026-449945.3OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenti CVE-2026-449957.3OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows a CVE-2026-449963.7OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply loca CVE-2026-449974.3OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sess CVE-2026-449985.4OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restr CVE-2026-449995.3OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron ag CVE-2026-45006.3A vulnerability was identified in bagofwords1 bagofwords up to 0.0.297. This impacts the function generate_df of the file backend/app/ai/cod CVE-2026-450005.0OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF p CVE-2026-450017.1OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fai CVE-2026-450025.3OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSession CVE-2026-450035.0OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology conne