CVE-2026-45003 MEDIUM

CVE-2026-45003: OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files

Vendor Openclaw
Product OpenClaw
Weakness CWE-441
Published May 11, 2026
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

Key dates

02Disclosure timeline

May 11, 2026 CVE published
May 11, 2026 Record updated