Disclosed weakness · no CVE recorded

OpenClaw plugins could reuse another connection’s search results or chat context

OpenClaw · OpenClaw

First documented disclosure · Review checkpoint

Summary

An agent could receive search results or chat context obtained using another connection’s credentials.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The project documents the defect and its correction. The reviewed sources identify no malicious use or victim.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Some plugin caches and shared connection lookups omitted the account, destination or network policy that governed the original result.

Conditions required

A deployment uses multiple plugin connections with differing access to a search service or chat platform.

Potential impact

A caller could see content beyond its account’s permissions or receive a result derived from the wrong connection.

Affected versions and configurations

The project identifies the affected behavior. Its full version range is unverified.

Fix and mitigation status

OpenClaw 2026.11.3 includes the correction. An earlier fixed build may exist.

Practical next steps

Update to a build with the plugin isolation fixes and review deployments that share plugin connections across accounts.

Operating lesson

Scope reused results to the account, service and policy that authorized their retrieval.

Evidence and limits

Two October 20 changes cover the same connection-isolation problem across different plugins. The project lists both in its November release.

Sources