CVE-2026-41357
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Apr 23, 2026
CISA due date
—
The record
OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations to leak sensitive environment variables from parent processes to SSH child processes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-81684 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI… CWE-214
- CVE-2026-80158 A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. CWE-214
- CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of… CWE-214
- CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM… CWE-214
- CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect. CWE-214
- CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly… CWE-214
- CVE-2026-12250 Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM… CWE-214
- CVE-2026-40159 PraisonAI is a multi-agent teams system. CWE-214