Disclosed weakness · no CVE recorded

OpenClaw could retain configuration secrets in local audit history

OpenClaw · OpenClaw configuration audit

First documented disclosure · Review checkpoint

Summary

Some conditional configuration changes wrote the new secret to the local audit history in cleartext.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documented the defect and its repair. The reviewed sources identify no malicious use.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The audit recorder could misidentify which value required masking when processing options on a conditional change.

Conditions required

An operator changes a setting classified as secret using the affected command form. Reading the stored copy requires access to the local audit data.

Potential impact

An audit reader or a copy of the audit store could expose the new value.

Affected versions and configurations

The project has not published a complete affected version range.

Fix and mitigation status

OpenClaw 2026.11.2 includes the fix. The exact first fixed release across all release lines is unverified.

Practical next steps

Update OpenClaw. Review access to older audit stores and backups, and rotate any credential that may have been recorded.

Operating lesson

Apply secret masking to the resolved setting before writing its value to audit storage.

Evidence and limits

The October 14 report predates the November repair. The repair masks future values and leaves existing audit rows unchanged.

Sources