Intel

CVE-2026-43584

openclaw: Incomplete List of Disallowed Inputs (CVE-2026-43584)

highEPSS 0.7%

Description

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity.

Source: CVE.org (MITRE)cvelistv5ENISA EUVDOSV (Open Source Vulnerabilities)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

npmopenclaw

Metrics

XIEM Effective CVSS
8.8
Source: nvd-v3
EPSS percentile
52.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
83.95
Exploit maturity
no public PoC known
CVSS v3
8.8
CVSS v4
8.7
EPSS score
0.7 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-05-06 19:49 UTC
CWE
CWE-184

Weakness classes (CWE)

  • CWE-184Base

    Incomplete List of Disallowed Inputs

    The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

    cwe.mitre.org →

References & sources