CVE-2026-100569 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech preferred that value over the configured region, so when a synthesis or voice-list request was made, the attacker-selected endpoint received the operator's Azure Speech key in the request header, allowing the key to be reused against the operator's Azure Speech resource. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content with Azure Speech configured with a key and region and no trusted endpoint override set. The issue is fixed in 2026.8.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions ranging from 2026.4.25 up to but not including 2026.8.1 represents a critical configuration management flaw within the application's workspace environment variable handling mechanism. This issue stems from an insufficient input validation process where the software fails to adequately sanitize or restrict specific environment variables that are loaded into the execution context of the application. Specifically, the internal filter designed to block potentially dangerous or untrusted environment variables did not account for variables ending with the suffix _ENDPOINT. This oversight allows any workspace configuration file, particularly those named .env which are commonly used by developers and operators to manage local settings, to inject arbitrary endpoint configurations into the running process without adequate scrutiny from the application's security controls.
The technical consequence of this flaw is most severe when OpenClaw is integrated with Microsoft Azure Speech services. In such deployments, the operator typically configures a specific region for speech synthesis or voice listing operations and provides an API key for authentication. Under normal circumstances, the application should prioritize these configured settings to ensure requests are routed correctly and securely. However, due to the filtering bypass described above, if an attacker controls the workspace content, they can define an AZURE_SPEECH_ENDPOINT variable within a malicious .env file. When OpenClaw starts with this untrusted configuration, it loads this endpoint value into its environment variables. The Azure Speech SDK logic then prioritizes the explicitly set endpoint over the default region configuration, effectively redirecting all speech-related API calls to a server controlled by the attacker rather than the legitimate Microsoft infrastructure.
The operational impact of exploiting this vulnerability is significant and centers on credential theft and unauthorized resource usage. When an operator initiates a synthesis or voice-list request while running in the compromised workspace environment, the application constructs HTTP requests that include the operator's valid Azure Speech API key in the authorization headers. Because these requests are directed to the attacker-controlled endpoint specified by the malicious AZURE_SPEECH_ENDPOINT variable, the attacker intercepts the full authentication credentials. This allows the adversary to reuse the stolen API key against the victim's Azure Speech resource. The implications extend beyond simple data exposure; the attacker can incur substantial costs on behalf of the victim, exhaust quota limits, or potentially use the compromised service for further malicious activities such as generating deceptive audio content that appears to originate from the legitimate organization.
This vulnerability aligns with CWE-798, which describes the use of hard-coded credentials, although in this context it is more accurately characterized by CWE-20 Improper Input Validation and CWE-15 External Control of System or Configuration Setting. The attack vector corresponds to ATT&CK technique T1552 Unsecured Credentials, specifically sub-technique T1552.004 Cloud Secrets Management, as the attacker extracts sensitive authentication material from a cloud service configuration environment. Furthermore, it reflects aspects of CWE-94 Improper Control of Generation of Code (Code Injection) in terms of influencing application behavior through external input manipulation, though primarily it is an environmental misconfiguration exploitation rather than direct code injection.
Mitigation for this vulnerability requires immediate action by operators using affected versions of OpenClaw with Azure Speech integration. The primary and most effective remediation is to upgrade the software to version 2026.8.1 or later, where the workspace environment-variable filter has been corrected to properly block variables ending in _ENDPOINT unless they are explicitly whitelisted by trusted sources. In environments where upgrading is not immediately feasible, operators should enforce strict controls over workspace content and ensure that no untrusted .env files can be loaded into the execution context. Additionally, implementing least-privilege principles for API keys and monitoring Azure Speech usage logs for anomalous endpoint connections or unexpected geographic regions of origin can help detect potential exploitation attempts before significant damage occurs. Regular auditing of environment variable configurations and restricting write access to workspace directories are also recommended defensive measures to prevent similar configuration-based attacks in the future.