OpenClaw versions prior to 2026.5.2 allow the CLOUDSDK_PYTHON environment variable to be set by a workspace .env file, which can be edited by anyone with write access to the repository. By tampering with this variable, an attacker can direct the gcloud command used in the Gmail setup to invoke a non‑trusted Python interpreter, giving the attacker the ability to run arbitrary code at the time of setup. The vulnerability is modeled as CWE‑426, an insecure credential disclosure or usage weakness.

The affected product is OpenClaw OpenClaw. All installations using a version earlier than 2026.5.2 are vulnerable; upgrading to 2026.5.2 or later removes the flaw.

The CVSS score of 7 indicates high severity. The EPSS score of less than 1% shows that current exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires repository write access, which is common in many collaborative projects. If an attacker controls repository settings or can commit malicious code, they can exploit this weakness during normal Gmail setup operations to execute arbitrary commands within the environment of the workflow runner.