Disclosed weakness · no CVE recorded

OpenClaw could expose an Exa search credential in a tool error

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

An Exa service error could put the active search credential into an error visible to an agent tool.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The plugin passed along provider error text without consistently removing a reflected search credential.

Conditions required

An affected Exa integration receives an upstream error containing its credential.

Potential impact

An agent, user or downstream tool with access to the error could see the search key.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Install a build with the Exa error fix and rotate any search credential found in retained tool errors.

Operating lesson

Redact provider credentials before forwarding error details to an agent.

Evidence and limits

The original public project discussion predates the November stable release. The reviewed sources give no CVE identity or CVSS score for this defect.

Sources