Veille CVE
CVE-2026-45003
5.0 MoyenneDescription
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 4.1 Moyenne | disclosure@vulncheck.com | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 5.0 Moyenne | disclosure@vulncheck.com | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
Faiblesses (CWE)
Références
- https://github.com/openclaw/openclaw/commit/0623079e98abf7202591f1b04a89755eb7ec9272 Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-55cf-xx38-4p9p Third Party Advisory
- https://www.vulncheck.com/advisories/openclaw-connector-endpoint-host-override-via-workspace-dotenv-files PatchThird Party Advisory