Which versions of Openclaw are affected by CVE-2026-33572?

CVE-2026-33572 presents notable security risk rated CVSS 6.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33572?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-33572

Q: What is the CVSS score of CVE-2026-33572?

CVE-2026-33572 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17024 MEDIUM

Creation of Temporary File With Insecure Permissions (CWE-378)

2026-03-29 VulnCheck

Information Disclosure Openclaw

6.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17024

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

Patch released

Mar 29, 2026 - 13:15 nvd

Patch available

CVE Published

Mar 29, 2026 - 12:44 nvd

MEDIUM 6.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.2.17.

DescriptionCVE.org

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.

AnalysisAI

OpenClaw before 2026.2.17 stores session transcript JSONL files with overly permissive default file permissions, enabling local authenticated users to read transcript contents and extract sensitive information including secrets from tool output. The vulnerability requires local access and authenticated status on the system, affecting confidentiality of cached session data. No public exploit code or active exploitation has been confirmed, though the attack surface is high given the local nature and ease of file access.

Technical ContextAI

OpenClaw uses JSONL (JSON Lines) format for session transcript storage, a standard text-based format for logging structured data. The underlying issue is a file permission misconfiguration (CWE-378: Insecure Default Permissions) where transcript files are created with permissions that allow unintended local users to read contents. This occurs during session creation or logging operations. The affected CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* indicates all versions before 2026.2.17 are vulnerable. Session transcripts typically contain tool outputs, model responses, and potentially embedded credentials or secrets passed through the application, making their disclosure a significant information disclosure vector.

RemediationAI

Vendor-released patch: OpenClaw 2026.2.17 or later. Users should upgrade immediately to apply the fix, which addresses the file permission configuration issue. The upstream fix is available at https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c. As an interim workaround for users unable to patch immediately, manually restrict access to session transcript directories using OS-level file permissions (e.g., chmod 700 on Linux/macOS, or restrictive ACLs on Windows) to prevent unauthorized local access. Review and secure any transcript files created prior to patching to ensure no sensitive data remains accessible.