Tag
OpenClaw versions up to 2026.3.28 are vulnerable to a workspace-level .env file overriding the bundled plugin trust root, potentially allowing for the execution of malicious plugins when an attacker-controlled workspace is loaded.