What CVEs were published for OpenClaw on May 11 2026?

CVE-2026-45006 (CVSS 8.8 gateway access control), CVE-2026-45004 (code exec via setup resolver), CVE-2026-45001 (guard bypass), CVE-2026-44995 (env var injection in MCP stdio).

What version fixes the May 11 OpenClaw CVEs?

CVE-2026-44995 and CVE-2026-45001 fixed in v2026.4.20. CVE-2026-45004 and CVE-2026-45006 fixed in v2026.4.23.

What is CVE-2026-45006?

CVSS 8.8 improper access control in OpenClaw gateway config.apply and config.patch. Compromised models bypass denylist to persist malicious config changes.

What is CVE-2026-45004?

Arbitrary code execution via plugin setup-api.js loaded from process.cwd(). Attackers place malicious file in repo extensions dir.

Is OpenClaw MCP server vulnerable?

CVE-2026-44995 allows env var injection (NODE_OPTIONS, LD_PRELOAD) into MCP stdio servers via malicious workspace configs. Fixed in v2026.4.20+.

← Back to dashboard

clawsmith.com/signal/openclaw-may-11-cve-batch-gateway-setup-resolver-env-injection

⚠ IssueWide OpenLive

OpenClaw May 11 CVE Batch: Gateway Access Control (8.8), Code Exec via Setup Resolver, Guard Bypass, Env Injection

Four new OpenClaw CVEs published May 11, 2026: CVE-2026-45006 (CVSS 8.8 gateway access control bypass), CVE-2026-45004 (arbitrary code exec via plugin setup-api.js), CVE-2026-45001 (guard bypass in config.patch), CVE-2026-44995 (env var injection in MCP stdio). All patched in v2026.4.20-4.23.

Product Idea from this Signal

A reverse proxy that locks OpenClaw gateway configuration against model-driven mutation by enforcing an allowlist of immutable protected settings

8 ▲

OpenClaw gateway config.patch and config.apply endpoints have been exploited through denylist bypass (CVE-2026-45006, CVE-2026-45001, CVE-2026-45004). Compromised models persist malicious config changes to sandbox policy, auth/TLS, and SSRF rules that survive restart. This tool flips the model from denylist to allowlist, intercepting all config mutations at the network layer.

SECURITYREVERSE-PROXYOPEN-SOURCEDEVTOOL

CompetitiveView Opportunity →