OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attack…

OpenClaw versions before 2026.2.17 contain a vulnerability where session transcript JSONL files are created with overly broad default permissions. This allows local users to read transcript contents and extract sensitive information including secrets from tool output. Attackers with local system access can exploit this vulnerability to access confidential data stored in session transcripts. The vulnerability has been addressed in version 2026.2.17 and above.