CVE-2026-8634 in openclaw's Crabbox prior to version 0.12.0 is an environment variable exposure vulnerability. It arises from overly permissive allowlisting of environment variables in repository-local Crabbox configurations, enabling attackers who control or compromise a repository to serialize and forward sensitive local environment variables (such as API tokens, cloud credentials, and broker tokens) into remote command execution environments. This improper control of code generation (CWE-94) leads to exposure of sensitive credentials in remote environments. The vulnerability has a critical CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation without privileges or user interaction.

Attackers with access to a malicious or compromised repository can exploit this vulnerability to expose sensitive local environment variables, including API tokens and cloud credentials, in remote command execution environments. This exposure can lead to credential theft and unauthorized access to cloud services or other resources that rely on these secrets. The vulnerability does not require privileges or user interaction to exploit, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using Crabbox versions prior to 0.12.0 with untrusted repositories or review and restrict environment variable allowlisting in repository-local configurations to prevent serialization of sensitive variables into remote commands.