{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/env-variable-override/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["openclaw","plugin-security","env-variable-override"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOpenClaw, a workspace application, is susceptible to a vulnerability where the \u003ccode\u003eOPENCLAW_BUNDLED_PLUGINS_DIR\u003c/code\u003e environment variable can be overridden by a \u003ccode\u003e.env\u003c/code\u003e file within a workspace. This allows a malicious actor to craft a workspace containing a \u003ccode\u003e.env\u003c/code\u003e file that points to a directory containing malicious plugins. If a user opens this attacker-controlled workspace in a vulnerable version of OpenClaw (\u0026lt;= 2026.3.28), the application will load and execute these malicious plugins. This vulnerability was reported by @nexrin and patched in version 2026.3.31. The risk is elevated when OpenClaw is used to process workspaces from untrusted sources.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious OpenClaw workspace.\u003c/li\u003e\n\u003cli\u003eWithin the workspace, the attacker creates a \u003ccode\u003e.env\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e.env\u003c/code\u003e file contains the line \u003ccode\u003eOPENCLAW_BUNDLED_PLUGINS_DIR=/path/to/attacker/plugins\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker places malicious plugins in the directory specified by \u003ccode\u003e/path/to/attacker/plugins\u003c/code\u003e. These could be JavaScript or other executable formats depending on OpenClaw's plugin architecture.\u003c/li\u003e\n\u003cli\u003eThe attacker distributes the malicious workspace to a victim. This could be via email, shared storage, or other means.\u003c/li\u003e\n\u003cli\u003eThe victim opens the malicious workspace with a vulnerable version of OpenClaw (\u0026lt;= 2026.3.28).\u003c/li\u003e\n\u003cli\u003eOpenClaw reads the \u003ccode\u003e.env\u003c/code\u003e file and sets the \u003ccode\u003eOPENCLAW_BUNDLED_PLUGINS_DIR\u003c/code\u003e environment variable accordingly.\u003c/li\u003e\n\u003cli\u003eOpenClaw loads and executes the attacker-controlled plugins from the specified directory, leading to arbitrary code execution within the context of the OpenClaw process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary code within the OpenClaw environment. The impact could include data theft, modification of workspace files, or further compromise of the victim's system. The severity is tied to user interaction as the victim must open the attacker-crafted workspace. While the number of affected users is not specified in the advisory, organizations using OpenClaw for sensitive projects are most at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.31 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect OpenClaw Plugin Directory Override\u003c/code\u003e to detect attempts to override the plugin directory via \u003ccode\u003e.env\u003c/code\u003e files.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring for OpenClaw workspaces to detect unauthorized modifications to \u003ccode\u003e.env\u003c/code\u003e files.\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of opening workspaces from untrusted sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-03T02:48:24Z","date_published":"2026-04-03T02:48:24Z","id":"https://feed.craftedsignal.io/briefs/2026-04-04-openclaw-env-override/","summary":"OpenClaw versions up to 2026.3.28 are vulnerable to a workspace-level .env file overriding the bundled plugin trust root, potentially allowing for the execution of malicious plugins when an attacker-controlled workspace is loaded.","title":"OpenClaw Workspace .env Overrides Bundled Plugin Trust Root","url":"https://feed.craftedsignal.io/briefs/2026-04-04-openclaw-env-override/"}],"language":"en","title":"CraftedSignal Threat Feed - Env-Variable-Override","version":"https://jsonfeed.org/version/1.1"}