OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust… (CVE-2026-62211)

The vulnerability in OpenClaw prior to version 2026.6.1 is a credential redaction bypass in the trajectory export feature. It permits lower-trust users to circumvent intended data redaction controls, exposing sensitive credentials and data through the export mechanism. The issue arises from improper handling of input paths or feature accessibility configurations that fail to enforce trust boundaries effectively. The CVSS 4.0 vector indicates local attack vector with low complexity and partial privileges required, resulting in high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is provided in the input data.

Attackers with lower trust levels can access sensitive credentials and data that should be restricted, potentially leading to unauthorized disclosure of confidential information. The impact affects confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten configuration of input paths and feature accessibility to ensure that lower-trust callers cannot access sensitive export functions. Monitor for vendor updates regarding official fixes.