CVE-2026-53842: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

OpenClaw's Gmail setup runs gcloud. The Google Cloud SDK reads CLOUDSDK_PYTHON to choose which Python binary starts its tooling. In affected versions, OpenClaw let a .env in the opened workspace influence that variable. A repository can ship a .env that points it at a Python path the attacker controls, for example a script in the same repo. When the operator runs Gmail setup, gcloud starts that interpreter instead of the system one.

The attacker needs the operator to open the repository and then run the Gmail setup feature, which fits the local vector with user interaction (AV:L, UI:R). The result is code running as the operator's user, with access to files, tokens and Google Cloud credentials on that machine. The advisory is careful about scope. It does not change OpenClaw's trusted-operator model, and the real impact depends on the operator's configuration and on whether lower-trust input can reach the path. It is the same class as the workspace .env problem in CVE-2026-53846, which affects a different variable and feature.

The npm package openclaw before 2026.5.2, only when the Gmail setup feature is used from a workspace containing a .env that sets CLOUDSDK_PYTHON. Check the version:

npm ls -g openclaw

Then look in repositories you open with OpenClaw for .env files that set CLOUDSDK_PYTHON.

Upgrade to openclaw 2026.5.2, the first stable patched version.

npm install -g [email protected]

Until patched, the advisory says to run Gmail setup only from trusted workspaces and to clear workspace env overrides. As general hardening it suggests narrow channel and tool allowlists, one Gateway per trust group, and disabling features you don't use.

Search workspaces you opened for .env files that define CLOUDSDK_PYTHON, and check that the value points at your own Python install. Review shell history and process logs for gcloud runs during Gmail setup that started an interpreter outside the system paths. Look for unexpected child processes of the gcloud wrapper. If a hostile .env was present when you ran setup, treat tokens on that machine as exposed. Beam records agent shell commands and file access, which helps show whether an agent read or wrote a workspace .env.

Summary

Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDK_PYTHON.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could run setup through an unintended local Python path. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.2.

Mitigations

run Gmail setup from trusted workspaces and clear workspace env overrides until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.