https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T10:25:48.218838+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-45003 CVE-2026-45003 — OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files 2026-10-03T10:25:51.331982+00:00

Affected: OpenClaw

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

 https://vulnerability.circl.lu/vuln/ghsa-55cf-xx38-4p9p GHSA-55cf-xx38-4p9p — OpenClaw: Workspace dotenv files cannot override connector endpoint hosts 2026-10-03T10:25:51.332131+00:00

Affected: npm: openclaw

## Summary Workspace dotenv files cannot override connector endpoint hosts.

## Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22

## Impact A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint.

## Fix Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate.

## Fix Commit(s) - 0623079e98abf7202591f1b04a89755eb7ec9272

## Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication.

OpenClaw thanks @qi-scape for reporting.