CVE-2026-27004: OpenClaw Package Session Tool Visibility Hardening Vulnerability
Summary
CVE-2026-27004: OpenClaw session tool visibility hardening and Telegram webhook secret fallback. Affects openclaw versions < 2026.2.15. Fixed in 2026.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source session management tool designed for multi-user environments, allowing operators to manage sessions effectively. It provides functionalities such as session listing, history tracking, and message sending. However, in shared-agent deployments, OpenClaw has been found to expose session tools to broader access than intended, particularly in environments where users may not be equally trusted.
Vulnerability Detail
The vulnerability arises from a configuration and visibility-scoping issue in OpenClaw's session tools, which can lead to unauthorized access to session transcripts across peer sessions in less-trusted, multi-user environments. Additionally, in Telegram webhook mode, the application fails to fall back to the per-account webhook secret if only the account-level secret is configured, potentially exposing sensitive information.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.15
This is the first release that contains the fix.
npm install openclaw@2026.2.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to session tools by adjusting the visibility settings in your configuration file. For example, set 'tools.sessions.visibility' to 'self' to limit access to the current user only.
Conclusion
The OpenClaw vulnerability CVE-2026-27004 highlights significant risks in multi-user environments where session tools may be improperly exposed. By updating to the patched version and enforcing proper visibility settings, users can mitigate these risks effectively.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
In shared-agent environments, unauthorized access to session transcripts could occur, leading to data exposure. In trusted environments, the impact is limited.
If an immediate update is not possible, consider implementing the visibility settings as a temporary measure to mitigate risks.
You can find more information about OpenClaw and its functionalities on its official GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
