OpenClaw, an npm‑distributed application, had a flaw that allowed an attacker to set an environment variable ending with _ENDPOINT in an untrusted workspace .env file. Because the workspace variable filter did not block such names between versions 2026.4.25 and before 2026.8.1, an attacker could control the AZURE_SPEECH_ENDPOINT value. Azure Speech would then prefer this attacker‑defined endpoint over the configured region, causing requests to that endpoint to carry the operator’s Azure Speech key in the header. This disclosure enables the attacker to reuse the key against the operator’s Azure Speech resource, effectively compromising the Cloud speech service credentials.

The vulnerability affects OpenClaw versions earlier than 2026.8.1, specifically those from 2026.4.25 up to but not including 2026.8.1. Operators using Azure Speech with a valid key and region while running OpenClaw from an untrusted workspace are at risk.

The global CVSS score for this flaw is 6.8, indicating a moderate severity that can lead to the exposure of confidential keys. An attacker must supply an untrusted workspace to the application and cannot rely on a trusted endpoint override, but once these conditions are met the exploit is straightforward and automatic. There is no publicly available EPSS score, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, the potential impact of leaking an Azure Speech key justifies proactive remediation.