T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/email-watch-lite.js:371- Finding
OpenClaw Agent Subprocess Inherits Raw Email Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/email-watch-lite.js:371-376
Related Credential Loading:scripts/email-watch-lite.js:6,scripts/imap.js:30-33
Vulnerability Type: Excessive subprocess privilege and secret exposure
Risk Level: HighVulnerable Code
js const { checkEmails } = require('./imap');Importing
scripts/imap.jsexecutes the following credential-loading code:js const EMAIL_ENV_DEFAULT = path.join(os.homedir(), '.openclaw', 'credentials', 'imap-smtp-mail.env'); const EMAIL_ENV_FILE = process.env.EMAIL_ENV_FILE || EMAIL_ENV_DEFAULT; require('dotenv').config({ path: EMAIL_ENV_FILE });The resulting environment is then passed without filtering to the AI-agent subprocess:
js const agentOutput = execFileSync(openclawBin, agentArgs, { cwd: WORKSPACE_ROOT, encoding: 'utf8', stdio: 'pipe', env: process.env, timeout: CHILD_PROCESS_TIMEOUT_MS, });Technical Analysis
Requiring
./imaploads the configured dotenv file into the watcher's globalprocess.env. This environment can containIMAP_PASS,SMTP_PASS, mailbox usernames, server addresses, and unrelated secrets inherited from the parent OpenClaw process.The watcher subsequently starts
openclaw agentwithenv: process.env, granting the entire subprocess direct access to every loaded credential. The agent needs to process pending email UIDs and can invoke the narrowly scoped mail scripts, but it does not need unrestricted possession of raw IMAP and SMTP passwords.Although
execFileSyncavoids shell command injection, it does not mitigate secret inheritance. Any compromised OpenClaw binary, loaded plugin, agent-accessible local tool, or other code executing in that subprocess can read the credentials directly from its environment.Attack Path
- The watcher imports
scripts/imap.js. scripts/imap.jsloads `~/.openclaw/credentials/imap-smtp-mail.e ...[truncated 1042 chars]
- The watcher imports
- Remediation
View remediation
Remediation Suggestions
- Replace
env: process.envwith an explicit allowlist containing only variables required by the OpenClaw CLI, such asPATH,HOME, locale settings, and narrowly selected OpenClaw configuration. - Explicitly remove
IMAP_PASS,SMTP_PASS, and other secret-bearing variables before creating the subprocess. - Avoid loading the credential file into the watcher's global environment. Refactor IMAP configuration loading so credentials are held in a local configuration object.
- Prefer a narrowly scoped local broker or capability interface that allows the agent to fetch designated UIDs without exposing mailbox credentials.
- Run the optional watcher under a dedicated account with minimal filesystem and environment access.
- Document the subprocess trust boundary and test that child processes cannot observe email passwords.
- Replace