OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification.…

CVE-2026-41396 affects OpenClaw versions before 2026.3.31, allowing workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable. This vulnerability compromises plugin trust verification mechanisms. Attackers who can control workspace configuration files can exploit this to inject malicious plugins by overriding the bundled plugin trust root directory. The vulnerability represents a significant supply chain security risk as it allows bypassing security controls intended to verify plugin authenticity and trustworthiness.