CVE-2026-33572

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan Creation of Temporary File With Insecure Permissions pada openclaw. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.

Rincian

Terbit di NVD

29 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-378: Creation of Temporary File With Insecure Permissions

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp advisory vendor
• https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c patch
• https://www.vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files advisory pihak ketiga