PT-2026-28496 · Openclaw · Openclaw

Hsongkai11 · Publicado 2026-03-16 · Atualizado 2026-03-29 · CVE-2026-33572

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.17

Description OpenClaw creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. An attacker with local access can read these transcript files and extract sensitive information, including secrets from tool output.

Recommendations Update OpenClaw to version 2026.2.17 or later.

Correção

Incorrect Default Permissions

Incorrect Permission

Enumeração de Fraquezas

CWE-276

CWE-378

CWE-732

Identificadores relacionados

CVE-2026-33572

GHSA-9Q8J-CHC7-WPGP

GHSA-VR7J-G7JV-H5MP

Produtos afetados

Openclaw

Referências · 9

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33572 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vr7j-g7jv-h5mp · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2038244572737032364 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-9q8j-chc7-wpgp · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038250144865341472 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files · Nota