OpenClaw Workspace .env Advisory: Who Needs to Upgrade
OpenClaw versions before 2026.5.28 could let workspace dotenv files override provider credentials. Here is the real exposure and operator response.
LATEST TRACKED HIGH ADVISORYGHSA-4pqj-3c56-5fqq · Workspace dotenv files could override provider credentials
Security desk
Scope first. Panic never.
Affected versions, exploit conditions, realistic exposure, fixed releases and safe mitigations—without turning every advisory into theatre.1 VERIFIED STORY