CVE-2026-44995

Description

OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to spawned MCP server processes, enabling code injection when operators start sessions using those servers.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: MEDIUM
CVSS score: 5.4 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 5.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-829
Reserved: 2026-05-08
Published: 2026-05-11 18:46 UTC
Last updated: 2026-05-11 19:57 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/44xxx/CVE-2026-44995.json
Linked Threat: CVE-2026-44995 — CVE-2026-44995

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-11 18:16:39 UTC
NVD last modified: 2026-05-13 14:11:44 UTC
NVD CVSS v3.1: 7.3 / 10 HIGH source: disclosure@vulncheck.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitability subscore: 1.3 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0001 (probability of exploitation in next 30 days)
EPSS percentile: 1.97% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-29140
Assigner: VulnCheck
Published: May 11, 2026, 4:46:35 PM
Updated: May 11, 2026, 5:57:02 PM
EUVD base score (CVSS 4.0): 5.4 / 10
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0100
Vendors: OpenClaw
Products: OpenClaw (0 <2026.4.20)

OpenClaw

ENISA description: OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to spawned MCP server processes, enabling code injection when operators start sessions using those servers.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
OpenClaw	OpenClaw	`0` (affected), `2026.4.20` (unaffected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

GitHub Security Advisory (GHSA-mj59-h3q9-ghfh) vendor-advisory
Patch Commit (1) patch
Patch Commit (2) patch
VulnCheck Advisory: OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables third-party-advisory

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Patch Commit (1) patch
VulnCheck Advisory: OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables third-party-advisory
Patch Commit (2) patch
GitHub Security Advisory (GHSA-mj59-h3q9-ghfh) vendor-advisory

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://nvd.nist.gov/vuln/detail/CVE-2026-44995 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-44995 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/openclaw/openclaw/commit/62fa5071896e95edc7f67d1cebc70a2859e283af disclosure@vulncheck.com Patch
https://github.com/openclaw/openclaw/commit/85d86ebc4bf3d2226d39d132a484f4f7a299fa1b disclosure@vulncheck.com Broken Link
https://github.com/openclaw/openclaw/security/advisories/GHSA-mj59-h3q9-ghfh disclosure@vulncheck.com Third Party Advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-mcp-stdio-environment-variables disclosure@vulncheck.com Third Party AdvisoryPatch

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

2026-05-23 21:01 UTC
Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...

web:cybersecuritynews.com

No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

2026-05-23 21:01 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:01 UTC
Microsoft Rushes to Mitigate Dangerous New "YellowKey" Windows Exploit

web:windowsreport.com

The newly exposed Windows security flaw, dubbed "YellowKey," has become a major headache for Microsoft. After the exploit details leaked publicly alongside a working proof-of-concept, the company has now rushed out official mitigation guidance while it prepares a permanent fix . The vulnerability reportedly targets BitLocker-protected systems and could allow attackers direct access to ...

2026-05-23 21:01 UTC
Risk Evaluation and Mitigation Strategies: Modifications and Revisions

web:www.fda.gov

This guidance provides information on how the FDA defines the types of changes to approved risk evaluation and mitigation strategies (REMS), how application holders should submit changes to an ...

2026-05-23 21:01 UTC
PDF Hazard Mitigation Assistance Program and Policy Guide

web:www.fema.gov

I am pleased to share the 2023 Hazard Mitigation Assistance Program and Policy Guide (HMA Guide) as FEMA's updated comprehensive policy handbook to govern mitigation grant programs.

2026-05-23 21:01 UTC
Error Code 45 on Device Manager for Intel® Bluetooth® or Wireless...

web:www.intel.com

Steps to resolve Error Code 45 in Device Manager.

2026-05-23 21:01 UTC
How to Fix Windows Defender Remediation Incomplete

web:www.majorgeeks.com

Windows Defender may try to remove a virus, trojan, or other malware and return a message stating Remediation incomplete. Remediation incomplete leads one to assume that a virus, trojan or malware was found, but not removed.

2026-05-23 21:01 UTC
Microsoft Rolls Out Mitigations for 'YellowKey' BitLocker ...

web:www.securityweek.com

Microsoft has announced mitigations for CVE - 2026 -45585, a BitLocker bypass triggered via FsTx in Windows Recovery.

2026-05-23 21:01 UTC
Patch CVE-2023-23397 Immediately: What You Need To Know and Do

web:www.trendmicro.com

Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step. CVE -2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes.

2026-05-23 21:01 UTC
Windows Kerberos RC4 deprecation: what will break in Active ... - 4sysops

web:4sysops.com

Starting in April 2026 , Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE - 2026 -20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...

2026-05-26 02:50 UTC
Oracle Critical Patch Update, April 2026 Security Update Review

web:blog.qualys.com

Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

2026-05-26 02:50 UTC
Security Advisory Bulletin 064 | Ubiquiti Community

web:community.ui.com

Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

2026-05-26 02:50 UTC
Nvd - Cve-2026-45585

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-26 02:50 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-26 02:50 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-26 02:50 UTC
Windows 11 April 2026 Update tested: What's new, improved and fixed

web:www.windowslatest.com

Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

2026-05-26 02:50 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-26 02:50 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-44995.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44995",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T17:56:23.350755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T17:57:02.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/openclaw",
          "product": "OpenClaw",
          "vendor": "OpenClaw",
          "versions": [
            {
              "lessThan": "2026.4.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2026.4.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
                  "versionEndExcluding": "2026.4.20",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Gus (@garagon)"
        }
      ],
      "datePublic": "2026-04-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to spawned MCP server processes, enabling code injection when operators start sessions using those servers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T16:46:35.083Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mj59-h3q9-ghfh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mj59-h3q9-ghfh"
        },
        {
          "name": "Patch Commit (1)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/62fa5071896e95edc7f67d1cebc70a2859e283af"
        },
        {
          "name": "Patch Commit (2)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/85d86ebc4bf3d2226d39d132a484f4f7a299fa1b"
        },
        {
          "name": "VulnCheck Advisory: OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-mcp-stdio-environment-variables"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-44995",
    "datePublished": "2026-05-11T16:46:35.083Z",
    "dateReserved": "2026-05-08T16:41:39.934Z",
    "dateUpdated": "2026-05-11T17:57:02.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}