Openclaw cli: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution (CVE-2026-53842)
Description
A vulnerability in openclaw-cli allows a workspace .env file to influence which Python runtime the gcloud command uses via the CLOUDSDK_PYTHON environment variable. This can affect the Gmail setup process when run by a trusted operator. The issue exists in versions from 2026.1.29 up to but not including 2026.5.2. The vulnerability does not alter the trusted-operator model but could lead to unintended Python execution paths if lower-trust input reaches the affected feature. A fix is available in version 2026.5.2.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw-cli tool has a vulnerability (CVE-2026-53842) where a workspace .env file can set the CLOUDSDK_PYTHON environment variable, influencing which Python runtime the gcloud command uses during Gmail setup. This occurs when a trusted operator opens a repository containing such a .env file. The vulnerability is scoped to this feature and does not affect the overall trusted-operator security model. The practical impact depends on the operator's environment and whether untrusted input can influence the workspace environment. The issue is fixed starting with version 2026.5.2.
Potential Impact
If exploited, this vulnerability could cause the gcloud Gmail setup process to run using an unintended local Python interpreter specified by the CLOUDSDK_PYTHON environment variable. This could lead to execution of unintended code or altered behavior during setup. The impact is high confidentiality and integrity impact (CVSS 7.1) but no availability impact. The actual risk depends on the operator's configuration and the trustworthiness of the workspace environment.
Mitigation Recommendations
A patch is available in openclaw-cli version 2026.5.2. Until patched, operators should run Gmail setup only from trusted workspaces and clear any workspace environment overrides. Additional mitigations include narrowing channel and tool allowlists, avoiding sharing a Gateway between mutually untrusted users, and disabling the affected feature when not needed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-53842
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2458c12601ec6a316412c
Added to database: 10/04/2026, 12:24:44 UTC
Last enriched: 10/04/2026, 12:36:10 UTC
Last updated: 10/04/2026, 16:08:39 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.