OpenClaw session tool visibility and Telegram webhook secret disclosure
OpenClaw session tools in shared-agent deployments reportedly allowed broader access to peer sessions than intended, and Telegram webhook secrets could fail to fall back to account-level configuration. The vulnerability was patched in version 2026.2.15 with visibility scoping controls.
What happened
In shared-agent deployments with multiple users, OpenClaw session tools (sessions_list, sessions_history, sessions_send) in versions β€ 2026.2.14 allowed broader session targeting than intended, exposing transcript content across peer sessions in less-trusted environments.
In Telegram webhook mode, monitor startup did not fall back to per-account webhookSecret configuration when only account-level secret was set, potentially missing secret wiring.
Reported impact
In shared-agent, multi-user, less-trusted environments, session-tool access could expose transcript content across peer sessions.
In single-agent or trusted deployments, practical impact was limited. In Telegram webhook mode, account-level secret configuration could be missed unless an explicit monitor webhook secret override was provided.
Index analysis
The vulnerability was classified as CWE-209 (generation of error message containing sensitive information) and CWE-346 (origin validation error).
Session tools lacked default visibility scoping in multi-user contexts, allowing peers to access sessions beyond their intended scope.
Governance controls
The fix introduced tools.sessions.visibility configuration (self | tree | agent | all) defaulting to tree, with sandbox clamping to restrict sandboxed runs to spawned or session-tree visibility.
Telegram webhook secret resolution was corrected to fall back to account-level configuration in monitor webhook startup when no explicit override was provided.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.