The vulnerability in OpenClaw prior to version 2026.6.6 involves a flaw in the filtering of environment variables during interpreter startup. When the affected feature is enabled and reachable, an attacker with lower privileges or a configured input path can supply crafted environment variables. This can lead to execution or persistence of actions beyond the caller's intended authorization scope, potentially escalating privileges or bypassing security controls. The issue is categorized under CWE-184 (Improper Access Control). No known exploits in the wild have been reported. No patch or remediation details are provided in the source data.

An attacker with lower trust or access to a configured input path can exploit this vulnerability to execute or persist actions beyond their intended authorization. This could lead to unauthorized code execution or persistence mechanisms, potentially compromising system integrity or security. The vulnerability affects the security boundary related to environment variable filtering in the host execution environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider disabling or restricting the affected feature if possible to reduce exposure.