CVE-2026-44992: OpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv
OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAXAPIHOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44992?
The severity of CVE-2026-44992 is considered high due to its potential to redirect sensitive API requests.
How do I fix CVE-2026-44992?
To fix CVE-2026-44992, update OpenClaw to version 2026.4.20 or later.
What specifically is vulnerable in CVE-2026-44992?
CVE-2026-44992 is vulnerable due to an environment variable injection issue that allows manipulation of the MiniMax API host.
Which versions of OpenClaw are affected by CVE-2026-44992?
OpenClaw versions from 2026.4.5 to 2026.4.19 are affected by CVE-2026-44992.
What can attackers do with CVE-2026-44992?
Attackers can exploit CVE-2026-44992 to redirect credentialed MiniMax API requests, potentially compromising sensitive information.