PT-2026-28496 · Openclaw · Openclaw

Hsongkai11 · Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-33572

Positive Technologies · (AI Summary)

CVSS v3.1

8.4

High

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.17

Description OpenClaw creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. An attacker with local access can read these transcript files and extract sensitive information, including secrets from tool output.

Recommendations Update OpenClaw to version 2026.2.17 or later.

Fix

Weakness Enumeration

CWE-378

Related Identifiers

CVE-2026-33572

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33572 · Security Note
• https://twitter.com/CVEnew/status/2038250144865341472 · Twitter Post
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp · Note
• https://vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files · Note
• https://twitter.com/TheHackerWire/status/2038244572737032364 · Twitter Post