CVE-2026-33572 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.17 contains an information disclosure vulnerability caused by overly broad default permissions on session transcript JSONL files, letting local attackers read sensitive transcript contents, exploit requires local access.

Severity & Score

Impact

Local attackers can read sensitive information including secrets from transcript files, potentially leading to information leakage.

Mitigation

Update to version 2026.2.17 or later.

References

• https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp
• https://www.vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner