Description
OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | 2026.4.5 – < 2026.4.20 | 2026.4.20 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | >= 2026.4.5, < 2026.4.20 | 2026.4.20 | GHSA-h2vw-ph2c-jvwf |
References
- GitHub Security Advisory (GHSA-h2vw-ph2c-jvwf) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw 2026.4.5 < 2026.4.20 - MiniMax API Host Override via Workspace dotenv third-party-advisory