Disclosed weakness · no CVE recorded

OpenClaw memory embedding requests could inherit credentials for a different destination

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

Agent-specific embedding configuration could retain credentials from a shared provider after the destination changed.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Memory configuration inheritance and setup could preserve a credential while changing the service selected to receive it.

Conditions required

An operator uses agent-specific memory embedding settings or changes shared embedding defaults.

Potential impact

An embedding service could receive credentials intended for a different provider.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Update to the corrected release and check the destination associated with each shared and agent-specific embedding credential.

Operating lesson

Revalidate stored credentials when a memory service changes.

Evidence and limits

The October correction covers primary configuration and setup. The maintainer describes an earlier, separate change for fallback provider selection. A complete affected range is unverified.

Sources