Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33572 OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers wi… https://www.cve.org/CVERecord?id=CVE-2026-33572
Post summary
The statement reveals a permission misconfiguration in OpenClaw that allows local users to read session transcript files, but it provides no evidence of exploitation or available patches.
🟠 CVE-2026-33572 - High OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read ... https://www.thehackerwire.com/vulnerability/CVE-2026-33572/ https://t.co/1Ddoosqzee
Post summary
The tweet announces CVE‑2026‑33572, highlighting improper default file permissions in OpenClaw that enable local users to read session transcripts, with no mention of exploitation, PoC, or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |