CVE-2026-33572 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.17 contains an information disclosure vulnerability caused by overly broad default permissions on session transcript JSONL files, letting local attackers read sensitive transcript contents, exploit requires local access.

Severity & Score

Impact

Local attackers can read sensitive information including secrets from transcript files, potentially leading to information leakage.

Mitigation

Update to version 2026.2.17 or later.

References

• https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp
• https://www.vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 29, 2026

🟠 CVE-2026-33572 - High (8.4) OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information includ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33572/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner