GHSA-55cf-xx38-4p9p

Suggest an improvement
Source
https://github.com/advisories/GHSA-55cf-xx38-4p9p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-55cf-xx38-4p9p/GHSA-55cf-xx38-4p9p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-55cf-xx38-4p9p
Aliases
  • CVE-2026-45003
Downstream
Published
2026-05-04T20:22:15Z
Modified
2026-05-19T16:00:13.553352183Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
Details

Summary

Workspace dotenv files cannot override connector endpoint hosts.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.4.21
  • Fixed version: 2026.4.22

Impact

A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint.

Fix

Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate.

Fix Commit(s)

  • 0623079e98abf7202591f1b04a89755eb7ec9272

Verification

  • The fix commit is contained in the public v2026.4.22 tag.
  • openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
  • Focused regression coverage for this path passed before publication.

OpenClaw thanks @qi-scape for reporting.

Database specific 
{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-427",
        "CWE-610"
    ],
    "github_reviewed_at": "2026-05-04T20:22:15Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.4.22

Database specific

last_known_affected_version_range 
"<= 2026.4.21"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-55cf-xx38-4p9p/GHSA-55cf-xx38-4p9p.json"