CVE-2026-33572: OpenClaw insecure transcript files

CISO Take

OpenClaw before 2026.2.17 stores AI agent session transcript files as world-readable JSONL, allowing any local user on the same host to read the full contents of every agent session without authentication. This is a high-severity finding (CVSS 8.4) specifically because AI agent transcripts routinely capture tool call inputs and outputs — including LLM provider API keys, cloud credentials, database connection strings, and sensitive documents — making this a trivial, no-privilege-required path to credential theft wherever OpenClaw runs alongside other users or services. An EPSS percentile in the top 98% of likely-exploited CVEs and a direct precedent in AIID #1368, where OpenClaw's ecosystem was actively abused for credential exfiltration via AMOS stealer, confirm this attack surface is already under adversary attention. Patch to 2026.2.17 immediately, restrict permissions on existing transcript files (chmod 600 on files, 700 on the session directory), and rotate any secrets that may have passed through agent tool calls on affected versions.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

The local attack vector limits exposure to environments with shared host access — development servers, CI/CD runners, containerized pipelines, and shared workstations — but this is precisely where AI agents are most commonly deployed. Within those environments, the attack requires zero privileges and zero complexity: any co-resident process, unprivileged user, or container with filesystem access can read all OpenClaw session transcripts with a single file read. AI agent session data is uniquely high-value compared to generic application logs because it captures complete tool invocation records, which routinely include credentials passed to cloud, database, and API tools. CWE-378 (insecure temporary file creation) is among the most trivially exploitable weakness classes. Risk is substantially elevated in shared AI development environments, multi-tenant cloud compute nodes, and CI/CD pipelines where OpenClaw agents run with deployment secrets.

How does the attack unfold?

Local Access

Attacker obtains unprivileged shell on host running OpenClaw via prior vulnerability, compromised CI/CD pipeline, or insider access.

AML.T0012

Transcript Discovery

Attacker enumerates world-readable OpenClaw session transcript JSONL files in other users' home directories or shared session paths using standard filesystem tools.

AML.T0037

Credential Extraction

Attacker reads transcript files and harvests API keys, cloud credentials, database connection strings, and other secrets captured verbatim in tool call output entries.

AML.T0055

Lateral Movement

Harvested credentials are used externally to authenticate to cloud services, LLM provider APIs, and internal databases, achieving lateral movement or data exfiltration with no trace in AI system logs.

AML.T0025

Local Access

Attacker obtains unprivileged shell on host running OpenClaw via prior vulnerability, compromised CI/CD pipeline, or insider access.

AML.T0012

Transcript Discovery

Attacker enumerates world-readable OpenClaw session transcript JSONL files in other users' home directories or shared session paths using standard filesystem tools.

AML.T0037

Credential Extraction

Attacker reads transcript files and harvests API keys, cloud credentials, database connection strings, and other secrets captured verbatim in tool call output entries.

AML.T0055

Lateral Movement

Harvested credentials are used externally to authenticate to cloud services, LLM provider APIs, and internal databases, achieving lateral movement or data exfiltration with no trace in AI system logs.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch OpenClaw to version 2026.2.17 immediately — this is the only complete remediation.
Locate and restrict existing transcript files: find the session directory (typically ~/.openclaw/sessions/ or the path in OPENCLAW_SESSION_DIR) and run chmod 600 on all JSONL files and chmod 700 on the directory.
Treat all sessions on affected versions as potentially compromised — rotate every credential that appeared in agent tool calls (LLM API keys, cloud IAM credentials, database passwords, internal tokens).
Add secret scanning to transcript directories as a detective control using tools like truffleHog or gitleaks on a scheduled basis.
In shared environments, run OpenClaw agents as dedicated service accounts whose home directories are not readable by other users or services.
Review CI/CD pipeline configurations that invoke OpenClaw agents and verify they use scoped, short-lived credentials rather than long-lived secrets.

How is it classified?

Data Extraction Privacy Violation Agent Framework AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8 - Data for AI systems

NIST AI RMF

GOVERN 6.1 - Policies for data privacy and security in AI systems

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-33572?

OpenClaw before 2026.2.17 stores AI agent session transcript files as world-readable JSONL, allowing any local user on the same host to read the full contents of every agent session without authentication. This is a high-severity finding (CVSS 8.4) specifically because AI agent transcripts routinely capture tool call inputs and outputs — including LLM provider API keys, cloud credentials, database connection strings, and sensitive documents — making this a trivial, no-privilege-required path to credential theft wherever OpenClaw runs alongside other users or services. An EPSS percentile in the top 98% of likely-exploited CVEs and a direct precedent in AIID #1368, where OpenClaw's ecosystem was actively abused for credential exfiltration via AMOS stealer, confirm this attack surface is already under adversary attention. Patch to 2026.2.17 immediately, restrict permissions on existing transcript files (chmod 600 on files, 700 on the session directory), and rotate any secrets that may have passed through agent tool calls on affected versions.

Is CVE-2026-33572 actively exploited?

No confirmed active exploitation of CVE-2026-33572 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33572?

1. Patch OpenClaw to version 2026.2.17 immediately — this is the only complete remediation. 2. Locate and restrict existing transcript files: find the session directory (typically ~/.openclaw/sessions/ or the path in OPENCLAW_SESSION_DIR) and run chmod 600 on all JSONL files and chmod 700 on the directory. 3. Treat all sessions on affected versions as potentially compromised — rotate every credential that appeared in agent tool calls (LLM API keys, cloud IAM credentials, database passwords, internal tokens). 4. Add secret scanning to transcript directories as a detective control using tools like truffleHog or gitleaks on a scheduled basis. 5. In shared environments, run OpenClaw agents as dedicated service accounts whose home directories are not readable by other users or services. 6. Review CI/CD pipeline configurations that invoke OpenClaw agents and verify they use scoped, short-lived credentials rather than long-lived secrets.

What systems are affected by CVE-2026-33572?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, CI/CD pipelines with AI agents, Shared AI development environments, Developer workstations running local agents.

What is the CVSS score for CVE-2026-33572?

CVE-2026-33572 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.12%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksCI/CD pipelines with AI agentsShared AI development environmentsDeveloper workstations running local agents

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.

Exploitation Scenario

An attacker with an unprivileged shell on a shared AI development server — obtained via a prior web vulnerability, compromised build pipeline, or insider access — runs a filesystem search for world-readable JSONL files and locates OpenClaw session transcripts in multiple developers' home directories. Because the files are readable by all local users due to the vulnerable default umask behavior, the attacker reads them directly without any privilege escalation. The transcripts contain complete tool call logs from developer sessions over the preceding weeks: an Anthropic API key used for local agent testing, AWS access keys invoked through a cloud management tool, and a PostgreSQL connection string used by a database query tool. The attacker extracts these credentials and authenticates externally to the AWS console and the production database, achieving lateral movement with no interaction with OpenClaw itself and no log entry in any AI system.

Weaknesses (CWE)

CWE-378 Creation of Temporary File With Insecure Permissions

CWE-378 — Creation of Temporary File With Insecure Permissions: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

[Requirements] Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
[Implementation] Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.

Source: MITRE CWE corpus.