N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h2vw-ph2c-jvwf

GHSA-h2vw-ph2c-jvwf: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: >= 2026.4.5, < 2026.4.20
Patched version: 2026.4.20

Impact

A malicious workspace .env could set MINIMAX_API_HOST and redirect credentialed MiniMax requests to an attacker-controlled origin, exposing the MiniMax API key in the outbound Authorization header.

This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.

Fix

OpenClaw now blocks MINIMAX_API_HOST from workspace dotenv injection and removes env-driven URL routing from the affected MiniMax request path.

Fix commit:

2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h2vw-ph2c-jvwf

GHSA-h2vw-ph2c-jvwf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.4.5, < 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the openclaw application's handling of workspace-specific .env files. The core of the issue is in the loadWorkspaceDotEnvFile function located in src/infra/dotenv.ts. This function failed to block the MINIMAX_API_HOST environment variable, allowing a malicious user with control over a workspace's .env file to override it.

When this variable is overridden, other parts of the application that interact with the MiniMax API are affected. Specifically, the minimaxUnderstandImage function (for VLM services) and the speech provider configured by buildMinimaxSpeechProvider (for TTS services) use MINIMAX_API_HOST to construct the API endpoint URL. Consequently, these functions would send credentialed API requests to an attacker-controlled server, leaking the MiniMax API key.

The fix was applied directly to loadWorkspaceDotEnvFile by adding MINIMAX_API_HOST and the generic _API_HOST suffix to the blocklist of environment variables that cannot be set by a workspace .env file. This prevents the initial injection of the malicious configuration, thus protecting the functions that consume this variable.

Vulnerable functions

loadWorkspaceDotEnvFile

src/infra/dotenv.ts

This function is responsible for loading environment variables from a workspace's `.env` file. Before the patch, it did not block the `MINIMAX_API_HOST` variable or variables with the `_API_HOST` suffix. This allowed an attacker to inject a malicious API host, redirecting credentialed requests. The patch adds these to the blocklist, preventing the malicious configuration from being loaded.

minimaxUnderstandImage

src/agents/minimax-vlm.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.