What is CVE-2026-44992?

CVE-2026-44992 is a medium-severity vulnerability in Openclaw, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 5.0/10. Published 2026-05-11.

How severe is CVE-2026-44992?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Vulnerability in Openclaw

CVE-2026-44992

OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled ori…

EPSS: 0.000 (1.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N.

Affected products

Openclaw — versions 2026.4.5, 2026.4.20

Weakness classification (CWE)

CWE-441 — Unintended Proxy or Intermediary (Confused Deputy)

References

GitHub Security Advisory (GHSA-h2vw-ph2c-jvwf) (vendor-advisory, Third Party Advisory)
Patch Commit (Patch, patch)
VulnCheck Advisory: OpenClaw 2026.4.5 < 2026.4.20 - MiniMax API Host Override via Workspace dotenv (Patch, Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-44992?: CVE-2026-44992 is a medium-severity vulnerability in Openclaw, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 5.0/10. Published 2026-05-11.
How severe is CVE-2026-44992?: Medium severity. CVSS v3 base score is 5.0 out of 10.