The vulnerability in OpenClaw prior to version 2026.6.6 involves improper sanitization of environment variables related to rustup startup within the host exec functionality. This environment variable filtering weakness can be exploited by attackers who have lower-trust caller access or control over input paths, enabling them to perform unauthorized execution or persistence actions. The issue is classified as an access control weakness (CWE-184) and has been assigned a high severity rating. No known exploits in the wild have been reported. There is no explicit patch or remediation information provided, and the affected versions are not explicitly listed but implied to be all versions before 2026.6.6.

Attackers with limited trust or configured input paths may leverage this vulnerability to execute or maintain unauthorized actions beyond their intended permissions. This could lead to privilege escalation or unauthorized persistence within the affected system. The vulnerability does not have confirmed exploits in the wild but presents a significant risk due to improper environment variable sanitization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict lower-trust caller access and carefully control input paths to reduce exposure to this vulnerability.