CVE-2026-33572
CVE-2026-33572 · OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.
CVSS 6.8 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp
- https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c
- https://www.vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files
- https://nvd.nist.gov/vuln/detail/CVE-2026-33572