Executive brief
OpenClaw is an agent orchestration framework that provides session management tools for multi-user environments. In shared-agent deployments where users don't fully trust each other, session tools could expose transcript content and user data across peer sessions due to insufficient visibility controls. Additionally, Telegram webhook authentication could fail silently in certain configurations, creating potential authentication gaps.
Technical details
The vulnerability encompasses two distinct issues: (1) Session tool visibility control — the sessions_list, sessions_history, and sessions_send tools in shared-agent deployments lacked proper visibility scoping, allowing tools to target sessions beyond the operator's intended scope (CWE-209, CWE-346). This is a configuration/authorization issue where insufficient access controls enabled cross-peer session data exposure. (2) Telegram webhook secret fallback — in Telegram webhook mode, monitor startup did not properly fall back to per-account webhookSecret configuration when only account-level secrets were set, potentially causing authentication to be misconfigured. Both issues affect only multi-user or shared-agent deployments; single-agent and trusted environments are minimally impacted. The patch enforces a tools.sessions.visibility configuration parameter (defaulting to "tree") and fixes webhook secret resolution logic.
Affected products
- OpenClaw OpenClaw <=2026.2.14
Timeline
- 2026-02-18: disclosed
- 2026-02-15: patched: Patched version 2026.2.15 planned as next release