CVE-2026-27004: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27004 is a session tool visibility and webhook secret misconfiguration vulnerability in OpenClaw, a personal AI assistant built on Node.js. Prior to version 2026.2.15, the session tools (sessions_list, sessions_history, sessions_send) lacked proper access scoping, allowing broader session targeting than intended in shared-agent, multi-user deployments. Additionally, in Telegram webhook mode, the monitor startup did not fall back to per-account webhookSecret when only the account-level secret was configured. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, OpenClaw Security Advisory).

The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information) and CWE-346 (Origin Validation Error). The root cause is a missing access-control enforcement layer on the session tools: without a tools.sessions.visibility configuration, the tools defaulted to an overly permissive scope, allowing any peer in a shared-agent deployment to query or retrieve transcript history from other users' sessions. A secondary issue involved the Telegram webhook monitor failing to resolve the per-account webhookSecret as a fallback when no explicit monitor-level override was provided, potentially leaving webhook endpoints without proper authentication. The fix introduced a tools.sessions.visibility setting (values: self, tree, agent, all) defaulting to tree, and added sandbox clamping to enforce stricter scoping for sandboxed sessions (GitHub Advisory, Fix Commit).

The primary impact is unauthorized disclosure of sensitive conversation transcript content across peer sessions in shared-agent, multi-user deployments where users are not equally trusted. An attacker with local access and low privileges could invoke session tools to enumerate and retrieve chat history belonging to other users, exposing potentially sensitive AI conversation data. In Telegram webhook mode, the missing secret fallback could allow unauthorized webhook access if no explicit monitor override was configured. Single-agent or fully trusted deployments face limited practical risk (GitHub Advisory, OpenClaw Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a shared-agent deployment with low privileges, limiting the attack surface primarily to multi-tenant or shared-instance OpenClaw environments (GitHub Advisory).

1. Identify target environment: Confirm the target is running OpenClaw prior to version 2026.2.15 in a shared-agent, multi-user deployment where multiple users share the same agent instance.
2. Obtain low-privileged access: Gain access to the OpenClaw environment as any authenticated user (e.g., via a legitimate user account in the shared deployment).
3. Invoke session listing tool: Call the sessions_list session tool without specifying a restricted scope. In unpatched versions, this returns sessions belonging to other users in the same agent deployment.
4. Retrieve cross-session transcripts: Use the sessions_history tool with a session key belonging to another user (obtained in step 3) to retrieve their full conversation transcript, including potentially sensitive AI interaction content.
5. Optionally interact with other sessions: Use sessions_send to inject messages into another user's session, depending on the deployment's tool allow-list configuration (GitHub Advisory, Fix Commit).

• Logs: Unusual calls to sessions_list, sessions_history, or sessions_send tools referencing session keys that do not belong to the requesting user's own session tree; repeated cross-user session key lookups in OpenClaw gateway logs.
• Application Behavior: Session tool invocations returning data from sessions with different user/sender identifiers than the requesting session; sessions_history responses containing transcripts from unrelated agent sessions.
• Configuration: Absence of tools.sessions.visibility configuration in OpenClaw config files on versions prior to 2026.2.15, indicating the permissive default was in effect; Telegram webhook monitor configured without an explicit webhookSecret override at the monitor level.

Upgrade OpenClaw to version 2026.2.15 or later, which introduces the tools.sessions.visibility setting defaulting to tree (current session plus spawned subagent sessions) and fixes the Telegram webhook secret fallback (GitHub Advisory, Fix Commit). For operators unable to upgrade immediately, explicitly set tools.sessions.visibility: "self" in the configuration to prevent cross-session browsing in shared-agent deployments. For Telegram webhook configurations, ensure an explicit monitor-level webhookSecret override is provided. Additionally, review and restrict the session tool allow-list (sessions_list, sessions_history, sessions_send) to only trusted operators in multi-user environments.

The vulnerability was reported by @aether-ai-agent and published by orlyjamie on February 18, 2026, with the fix committed the same day. The advisory was reviewed and published to the GitHub Advisory Database on February 18, 2026, and subsequently published by the National Vulnerability Database on February 20, 2026 (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.