In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in _ENDPOINT, so an untrusted… (CVE-2026-100569)
OpenClaw versions from 2026.4.25 up to but not including 2026.8.1 contain a vulnerability where the workspace environment-variable filter fails to block variables ending in _ENDPOINT. This allows an untrusted workspace .env file to set the AZURE_SPEECH_ENDPOINT variable, causing Azure Speech requests to be redirected to an attacker-controlled endpoint with the operator's Azure Speech key included in the request header. Exploitation requires the operator to start OpenClaw in a malicious workspace with Azure Speech configured and no trusted endpoint override. The issue is fixed in version 2026.8.1.
AI Analysis
Technical Summary
In OpenClaw versions >= 2026.4.25 and < 2026.8.1, the environment-variable filtering mechanism did not block variables ending with _ENDPOINT, such as AZURE_SPEECH_ENDPOINT. An attacker controlling the workspace .env file could set this variable, causing Azure Speech API requests to be sent to an attacker-chosen endpoint. Since Azure Speech prefers this endpoint over the configured region, the operator's Azure Speech key is sent in the request header, enabling the attacker to reuse the key against the operator's Azure Speech resource. Exploitation requires the operator to launch OpenClaw in a workspace with attacker-controlled content and Azure Speech configured with a key and region, without a trusted endpoint override. The vulnerability is resolved in OpenClaw version 2026.8.1.
Potential Impact
An attacker can cause OpenClaw to send the operator's Azure Speech key to an attacker-controlled endpoint, potentially allowing unauthorized use of the operator's Azure Speech resource. This exposure is limited to scenarios where the operator starts OpenClaw in a malicious workspace with Azure Speech configured and no trusted endpoint override. The vulnerability does not impact confidentiality or integrity of other data and does not affect availability.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.8.1 or later, where this vulnerability is fixed. Until then, operators should avoid starting OpenClaw in untrusted or attacker-controlled workspace environments with Azure Speech configured and no trusted endpoint override. No other mitigations are specified.
In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in _ENDPOINT, so an untrusted… (CVE-2026-100569)
Description
OpenClaw versions from 2026.4.25 up to but not including 2026.8.1 contain a vulnerability where the workspace environment-variable filter fails to block variables ending in _ENDPOINT. This allows an untrusted workspace .env file to set the AZURE_SPEECH_ENDPOINT variable, causing Azure Speech requests to be redirected to an attacker-controlled endpoint with the operator's Azure Speech key included in the request header. Exploitation requires the operator to start OpenClaw in a malicious workspace with Azure Speech configured and no trusted endpoint override. The issue is fixed in version 2026.8.1.
CVSS v3.1
Score 5.5medium
Affected software
pkg:github/openclaw/openclawRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw versions >= 2026.4.25 and < 2026.8.1, the environment-variable filtering mechanism did not block variables ending with _ENDPOINT, such as AZURE_SPEECH_ENDPOINT. An attacker controlling the workspace .env file could set this variable, causing Azure Speech API requests to be sent to an attacker-chosen endpoint. Since Azure Speech prefers this endpoint over the configured region, the operator's Azure Speech key is sent in the request header, enabling the attacker to reuse the key against the operator's Azure Speech resource. Exploitation requires the operator to launch OpenClaw in a workspace with attacker-controlled content and Azure Speech configured with a key and region, without a trusted endpoint override. The vulnerability is resolved in OpenClaw version 2026.8.1.
Potential Impact
An attacker can cause OpenClaw to send the operator's Azure Speech key to an attacker-controlled endpoint, potentially allowing unauthorized use of the operator's Azure Speech resource. This exposure is limited to scenarios where the operator starts OpenClaw in a malicious workspace with Azure Speech configured and no trusted endpoint override. The vulnerability does not impact confidentiality or integrity of other data and does not affect availability.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.8.1 or later, where this vulnerability is fixed. Until then, operators should avoid starting OpenClaw in untrusted or attacker-controlled workspace environments with Azure Speech configured and no trusted endpoint override. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5cqq-r556-6vv9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100569"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab74f2af7a7c54106e1382e
Added to database: 09/26/2026, 04:50:50 UTC
Last enriched: 09/26/2026, 04:54:44 UTC
Last updated: 09/26/2026, 13:47:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.