OpenClaw prior to 2026.4.20 contains a weakness in the MCP stdio server configuration that fails to validate environment variables correctly. An attacker who can influence workspace configurations can inject variables such as NODE_OPTIONS, LD_PRELOAD, or BASH_ENV into the server startup process. When an operator initiates a session using the affected MCP server, those variables are applied and can cause the MCP server to execute malicious code, giving the attacker code execution with the privileges of the MCP server process. The flaw maps to CWE‑829 and allows the attacker to run arbitrary code on the host where the MCP server runs.

The vulnerability affects OpenClaw software, versions earlier than 2026.4.20. The affected product is the OpenClaw application running on a Node.js runtime. Any installation that includes the MCP stdio server component and allows workspace configuration of environment variables is susceptible.

The CVSS score of 5.4 classifies the flaw as medium severity. EPSS is not provided and the vulnerability is not listed in CISA KEV, indicating no publicly documented exploits at the time of analysis. The attack can be carried out by maliciously modifying workspace configuration files or environment settings that the MCP server processes, which requires either ownership of the configuration space or the ability to tamper with the environment in which the server starts. Consequently, internal actors or compromised configuration files pose the highest risk, while remote exploitation would need initial access to influence startup variables.