Full Report
Making installation easier and putting a new wrapper on the interface while leaving most of the security to users is a recipe for more trouble with the popular agent harness
Analysis Summary
# Vulnerability: Weak Security Defaults and Unencrypted Secret Storage in OpenClaw 2.0
## CVE Details
- **CVE ID**: Not explicitly assigned in the text (Common for architectural flaws in early-stage open-source projects).
- **CVSS Score**: Estimated 7.5 (High) based on lack of encryption and default sandbox status.
- **CWE**:
- CWE-311: Missing Encryption of Sensitive Data
- CWE-276: Incorrect Default Permissions
- CWE-265: Privilege/Sandbox Issues
## Affected Systems
- **Products**: OpenClaw AI Agent Harness
- **Versions**: Versions prior to 2.0 and version 2.0 (specifically the new "Shared Cloud Sessions" and "Secret Store" features).
- **Configurations**: Default installations where users have not manually hardened filesystem permissions or enabled the opt-in sandbox.
## Vulnerability Description
OpenClaw 2.0 introduces several architectural security weaknesses despite a major version overhaul:
1. **Unencrypted Secrets at Rest**: The new "Protected Credentials" feature stores sensitive values in a local secret store that is not encrypted at rest. It relies entirely on the host filesystem permissions of the OpenClaw state directory.
2. **Lack of Tenant Isolation**: The "Shared Cloud Sessions" feature, designed for team collaboration, does not provide a formal security boundary or tenant isolation, potentially leading to cross-user context leakage.
3. **Disabled Security Defaults**: The new sandbox environment for isolating untrusted contributor-controlled code is disabled by default, requiring manual user intervention to secure the execution environment.
## Exploitation
- **Status**: PoC Available (Implicitly demonstrated via Prof. Hannah Fry's tests and gym waitlist incidents).
- **Complexity**: Low (Exploiting lack of encryption or default settings).
- **Attack Vector**: Local (for secret theft) | Network (for agent manipulation).
## Impact
- **Confidentiality**: High (Credentials stored in plain text on the filesystem).
- **Integrity**: High (Agents can be manipulated to perform unauthorized actions like modifying external databases).
- **Availability**: Medium (Potential for agentic loops to disrupt services).
## Remediation
### Patches
- **Version 2.0**: Contains the new Secret Store and Sandbox features, but they require manual configuration. There is currently no patch that enables these by default or adds at-rest encryption.
### Workarounds
- **Manual Sandboxing**: Users must explicitly enable the sandbox via the configuration settings (refer to `https[:]//docs[.]openclaw[.]ai/gateway/sandboxing`).
- **Filesystem Hardening**: Restrict access to the OpenClaw state directory using OS-level permissions (chmod/chown) to prevent unauthorized local access to the unencrypted secret store.
- **Credential Rotation**: Frequently rotate any credentials shared with the agent.
## Detection
- **Indicators of Compromise**:
- Unauthorized access to the OpenClaw state directory.
- Unexpected automated actions performed by agents (e.g., unauthorized API calls or database modifications).
- **Detection Methods**:
- Monitor filesystem integrity for the state directory.
- Audit OpenClaw logs for shared session activity that crosses intended user boundaries.
## References
- **Vendor Release Notes**: hxxps[:]//docs[.]openclaw[.]ai/releases/2026[.]8[.]1
- **Sandboxing Documentation**: hxxps[:]//docs[.]openclaw[.]ai/gateway/sandboxing
- **Cloud Sessions Advisory**: hxxps[:]//docs[.]openclaw[.]ai/gateway/cloud-sessions
- **Foundation Announcement**: hxxps[:]//openclaw[.]ai/blog/openclaw-2-accidentally/