CVE-2026-101884 is a High (CVSS 7.5) flaw in OpenClaw Windows Node, whose environment sanitizer misses variables such as GIT_CONFIG_*, DOTNET_STARTUP_HOOKS and JAVA_TOOL_OPTIONS. An allowlisted tool can then load attacker code. The record says before 2026.7.1; the advisory names v2026.7.1-3 as patched, so update to that build or later.
What's affected
The weakness is CWE-184 (incomplete list of disallowed inputs). The record says OpenClaw Windows Node before 2026.7.1 is affected. The GitHub advisory names v2026.7.1-3 as the patched version, so aim for that build or later.
The system.run feature lets a caller supply an environment dictionary, which a sanitizer filters before the child process starts. The advisory says the sanitizer is a denylist. It blocks classic hijack variables such as PATH, NODE_OPTIONS and LD_PRELOAD, but misses several that make common tools run extra code. The ones named in the record are the git configuration variables, the .NET startup hooks variable and the Java tool options variables.
The effect is that a caller who is allowed to run a bounded tool, for example git, can supply a crafted environment and make that tool execute something else. The step goes from running one allowed tool to running arbitrary code on the host. The vector is network, high attack complexity, low privileges, no user interaction, and the record rates all three impact measures High.
How to check if you're exposed
Check the node version through the application, the installed programs list or the executable's file version, and compare it with v2026.7.1-3.
Then review your allow rules. Which tools are allowed? git, dotnet and java appear in the record because they read these variables, but any interpreter or tool that honours environment based hooks deserves a look.
Review how callers pass environment values. If your gateways or agents are allowed to set arbitrary environment variables for a run, that is the capability this flaw abuses. Limit it to the few names that your workflows need.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Update OpenClaw Windows Node to v2026.7.1-3 or later.
- Replace denylist thinking with an allowlist: permit only the environment variable names your jobs need.
- Review allowed tools, in particular git, dotnet and java, and the arguments they may take.
- Limit which gateways and agents can send run requests to a node.
- Run nodes under a limited Windows account.
Why it matters
A denylist has to name every dangerous variable in advance, and tools keep adding new ones. An allowlist of the names a job truly needs is far safer. This flaw is a good example: each of the missed variables is documented behaviour of a common tool.
The same issue was reported alongside an approval bypass, CVE-2026-101880, in the same release. Updating covers both. The record does not mark either CVE as known exploited.
Quick check
Which variables were missed?
The record names GIT_CONFIG_*, DOTNET_STARTUP_HOOKS and JAVA_TOOL_OPTIONS. The advisory also mentions related git and Java variables.
Is this related to CVE-2026-101880?
It is a separate flaw in the same product and the same fix release line. Update once to cover both.
Sources
Last reviewed: 18 October 2026.
