CVE-2026-100570: OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpreter. A crafted CLOUDSDKPYTHONARGS value can therefore cause Python to execute attacker-supplied code with the OpenClaw host user's permissions, allowing credentials to be read, files to be modified, or other processes to be started. This issue is fixed in version 2026.8.1; as a workaround, run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK variables beforehand.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1 - Compensating control
Run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand.
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
OpenClaw npm package versions from 2026.3.28 up to, but not including, 2026.8.1 are affected. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content and run the Gmail setup flow.
What access or interaction does an attacker need?
An attacker needs to control the workspace content sufficiently to provide an untrusted .env file that sets CLOUDSDK_PYTHON_ARGS. They do not need prior privileges on the OpenClaw host, but an operator must run the Gmail setup flow from that workspace.
What is the impact if exploitation succeeds?
Attacker-supplied Python code executes with the permissions of the host user running OpenClaw. This can allow reading credentials, modifying files, and starting other processes accessible to that user.
What can be done before upgrading?
Run the Gmail setup flow only from trusted workspaces. Before running it, clear inherited CLOUDSDK_* environment variables, including CLOUDSDK_PYTHON_ARGS.
How can I remediate the issue?
Upgrade OpenClaw to version 2026.8.1 or later. The issue is fixed in 2026.8.1.