OpenClaw versions before 2026.4.20 suffer from an environment variable injection flaw that allows the workspace dotenv file to override the MINIMAX_API_HOST setting. By manipulating this variable, an attacker can redirect authenticated MiniMax API calls to a malicious endpoint, causing the MiniMax API key to be sent in the Authorization header and thereby exposing the key to the adversary.

OpenClaw from the OpenClaw vendor is affected; all releases prior to version 2026.4.20 that run in a Node.js environment are susceptible. Users should verify the exact build they are using against this version threshold.

The CVSS score of 4.1 indicates moderate severity, and no exploit probability data is available while the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to alter the workspace dotenv file, which is usually possible with local or workspace‑level file access. Once the variable is overridden, the attacker can redirect requests and capture the MiniMax API key, but the flaw does not permit full system compromise or arbitrary code execution.