OpenClaw versions released before 2026.3.28 contain a flaw in the jq safe‑bin policy that fails to block the $ENV filter. An attacker who can supply a jq program to the application can bypass these restrictions and read environment variables that should be protected. The vulnerability allows disclosure of potentially sensitive information such as database credentials, API keys, or other secrets, which can be leveraged in further attacks such as credential theft or privilege escalation. The weakness is a form of CWE‑668, where untrusted data is used to access system resources.

The affected product is OpenClaw, a Node.js application. All releases prior to version 2026.3.28 are vulnerable; later releases implement a fix that disallows the $ENV filter in the safe‑bin policy.

The CVSS score of 7.1 indicates a high severity for information disclosure. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog, suggesting no current known public exploits. The attack vector is inferred to be remote in nature, requiring the attacker to inject a jq program via an exposed API or configuration file that is parsed by the application. Once the vulnerability is triggered, the attacker can read any environment variable the process has access to, potentially compromising critical secrets and downstream systems.