CVE-2026-100569: OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, so when a synthesis or voice-list request was made, the attacker-selected endpoint received the operator's Azure Speech key in the request header, allowing the key to be reused against the operator's Azure Speech resource. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content with Azure Speech configured with a key and region and no trusted endpoint override set. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to credential theft?
OpenClaw versions from 2026.4.25 through before 2026.8.1 are exposed when an operator starts the application in attacker-controlled workspace content, Azure Speech is configured with both a key and region, and no trusted endpoint override is set.
What interaction is required for exploitation?
An attacker needs to provide workspace content containing an untrusted .env file. The operator must start OpenClaw in that workspace, and a subsequent Azure Speech synthesis or voice-list request causes the Azure Speech key to be sent to the attacker-selected endpoint.
What can be done if upgrading is not immediately possible?
Do not start affected OpenClaw versions in untrusted or attacker-controlled workspaces. Ensure untrusted workspace .env files cannot set Azure Speech endpoint configuration; a trusted endpoint override prevents the described condition.
How can an operator determine whether a key may have been exposed?
Review whether an affected version was run in attacker-controlled workspace content with Azure Speech configured by key and region, without a trusted endpoint override. If so, Azure Speech synthesis or voice-list requests may have sent the key to an attacker-selected endpoint, and the key should be treated as exposed.