CVE-2026-44992
MEDIUM
NVD
CVSS Score
5
Severity
MEDIUM
Published
May 11, 2026
Vendor
unknown
Description
OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled origins, exposing the MiniMax API key in Authorization headers.