CVE-2026-53842: OpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable

Synopsis

An environment variable injection vulnerability in OpenClaw before version 2026.5.2 allows an attacker who can write to a workspace .env file to redirect Python runtime selection by setting the CLOUDSDK_PYTHON variable, which is consumed during Gmail setup gcloud execution. Exploitation requires local repository access and a user to trigger the affected setup flow. Successful exploitation gives the attacker arbitrary code execution with the privileges of the user running the setup process. A patched-image rebuild at version 2026.5.2 is available on HarborGuard for environments running an affected version of OpenClaw.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable code path.

• AuthenticationNot required

  No authentication to the host system is required, though the attacker must have repository write access to place or modify a workspace .env file.

• Victim interactionRequired

  A user must actively trigger the Gmail setup gcloud execution flow, making this a social-engineering or insider-access vector that depends on user action.

• Attack complexityDetail

  While exploiting the variable injection itself is straightforward, the CVSS AT:P token indicates the attack depends on specific preconditions, namely the attacker having .env write access and the victim running the affected setup command.

Blast Radius

• An attacker executes arbitrary code in the context of the user running the OpenClaw Gmail setup flow, gaining whatever filesystem and process permissions that user holds.
• All files and credentials readable by the affected user process, including local secrets, API keys, and cached authentication tokens, become accessible to the attacker-controlled Python binary.
• The attacker can persist malicious code or exfiltrate data without modifying the OpenClaw application itself, making detection harder through standard log review.