OpenClaw before 2026.4.22 permits users with workspace access to manipulate dotenv files, allowing them to override the endpoint hosts for built‑in connectors such as Matrix, Mattermost, IRC, and Synology. By setting custom endpoint variables, an attacker can redirect traffic that the application sends to these connectors to arbitrary malicious servers, potentially capturing or tampering with the data transmitted to or from these services. The vulnerability is a configuration‑based weakness (CWE-441). The impacted systems may therefore expose sensitive information or allow further compromise of downstream services even though the application itself is not directly compromised.

The affected product is OpenClaw as distributed before version 2026.4.22. Any deployment using the Matrix, Mattermost, IRC, or Synology connectors is susceptible, provided the attacker can modify or add dotenv files within the workspace. No additional vendor or model information is available beyond the OpenClaw product name.

The CVSS score of 4.1 indicates a moderate impact level. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker with the ability to write workspace dotenv files can configure the application to point the connectors at an attacker‑controlled endpoint. The scope is limited to users who have workspace access, so the risk is mitigated if strict access controls are in place, but it remains a concern if any untrusted user can modify these files.