N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9gp8-hjxr-6f34

GHSA-9gp8-hjxr-6f34: OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

Summary

Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

4d912e04519b4bd53b248437c53748cdebce9a41 — 2026-03-31T21:25:36+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9gp8-hjxr-6f34

GHSA-9gp8-hjxr-6f34:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of environment variable overrides for commands executed on the host. The system allowed users to override sensitive environment variables such as HTTPS_PROXY, NODE_TLS_REJECT_UNAUTHORIZED, and DOCKER_HOST. This could allow an attacker to redirect network traffic to a malicious server, disable TLS certificate validation, or take control of the Docker daemon, leading to information disclosure or remote code execution.

The patch addresses this by introducing a blocklist of sensitive environment variable keys that should not be overridden by users. The core logic change is in the sanitizeHostExecEnv function, which now distinguishes between trusted, inherited environment variables and user-provided overrides, discarding any dangerous overrides. This fix is then propagated to higher-level functions like applySkillEnvOverrides (for agent skills) and the execute method of the command execution tool, which are the primary entry points for this vulnerability.

Vulnerable functions

applySkillEnvOverrides

src/agents/skills/env-overrides.ts

This function applies environment variable overrides from skill configurations. It was vulnerable because it did not block sensitive environment variables related to proxies, TLS, and Docker. The patch introduces a call to `isDangerousHostEnvOverrideVarName` within the `isAlwaysBlockedSkillEnvKey` helper function, which is used by `applySkillEnvOverrides` to prevent dangerous overrides.

sanitizeHostExecEnv

src/infra/host-env-security.ts

This is the core function for sanitizing environment variables for host execution. It was vulnerable because it allowed user-provided `overrides` to set sensitive environment variables like `HTTPS_PROXY`, `DOCKER_HOST`, and `NODE_TLS_REJECT_UNAUTHORIZED`. This could be exploited to reroute traffic, disable TLS verification, or connect to a malicious Docker daemon. The patch modifies this function to ignore such overrides, only allowing trusted values from the base environment.

execute

src/agents/bash-tools.ts

This function, part of a tool for executing shell commands, was an entry point for the vulnerability. It accepted an `env` object from the user and passed it to the sanitization logic. Because the underlying sanitization in `sanitizeHostExecEnv` was flawed, a user could provide malicious environment variables (like `HTTPS_PROXY`) to the `execute` function. This could lead to the command being executed in a compromised environment (e.g., with traffic being routed through a malicious proxy). The patch ensures that calls to this function with dangerous environment variable overrides are rejected before command execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.