CVE-2026-53858: OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable

Synopsis

An environment variable injection vulnerability in OpenClaw before version 2026.5.2 allows an attacker to manipulate the STATE_DIRECTORY variable in a workspace .env file, redirecting runtime dependency resolution to attacker-controlled local paths. The attack requires local access and a victim to interact with a malicious workspace, but no credentials are needed. Successful exploitation allows arbitrary code execution when OpenClaw resolves its bundled runtime dependencies. A patched-image rebuild at version 2026.5.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationNot required

  No credentials are required; the attacker does not need any account on the system to stage the malicious STATE_DIRECTORY value.

• Victim interactionRequired

  A victim must open or process the malicious workspace containing the poisoned .env file, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Although the exploit logic itself is straightforward, successful exploitation depends on a specific precondition (AT:P), meaning particular environmental or timing factors must align for dependency resolution to be redirected.

Blast Radius

• The attacker executes arbitrary code in the context of the OpenClaw process by redirecting runtime dependency loading to a malicious local path.
• All data accessible to the running OpenClaw process, including stored credentials, tokens, and workspace files, is exposed to the attacker (VC:H).
• The attacker can write or modify any files and data that the OpenClaw process has permission to access (VI:H).
• Service availability is not directly affected by this vulnerability (VA:N).