A vulnerability, which was classified as problematic , was found in OpenClaw up to 2026.5.1 . Affected by this issue is some unknown functionality of the component Environment Variable Handler . The manipulation of the argument STATE_DIRECTORY results in untrusted search path. This vulnerability is cataloged as CVE-2026-53858 . The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.