Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44992: OpenClaw can let attackers hijack MiniMax API calls

CVE-2026-44992 · published 5 months ago

Summary

Versions of OpenClaw released before 2026.4.20 let a specially crafted setting file change the address that the MiniMax service talks to. This can cause requests that contain the MiniMax API key to be sent to a site the attacker controls, exposing the key. Update OpenClaw to version 2026.4.20 or later to stop the redirection.

What to do

Update GitHub Actions openclaw to version 2026.4.20.
Update openclaw openclaw to version 2026.4.20 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	openclaw	>= 2026.4.5, < 2026.4.20 Fix: upgrade to 2026.4.20
–	openclaw	openclaw	>= 2026.4.5, < 2026.4.20 `cpe:2.3:a:openclaw:openclaw::::::node.js::*`

Original advisory text

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.

References

https://github.com/openclaw/openclaw/commit/2f06696579a1ab0cb5bbbbb6a900414a6b2e... Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwf Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44992 Vendor Advisory
https://github.com/openclaw/openclaw Product
https://www.vulncheck.com/advisories/openclaw-minimax-api-host-override-via-work... Patch Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-441Unintended Proxy or Intermediary ('Confused Deputy')

CWE-15External Control of System or Configuration Setting

CWE-522Insufficiently Protected Credentials

Timeline

Published11 May 2026

Updated26 Oct 2026

First seen11 May 2026

Sources

CVE-2026-44992 · NVD

GHSA-h2vw-ph2c-jvwf · OSV

Track software like this

Free during beta