CVE-2026-31204
Information Disclosure via Debug Mode Default
What this means in plain English
If you installed OpenClaw using certain common methods, it may be logging every conversation your AI agents have — including sensitive instructions, API responses, and potentially credentials — in plain text to a log file any application on your machine can read.
Technical description
OpenClaw defaults to debug mode in certain installation scenarios, exposing full session logs including agent instructions and responses to any process reading the log file.
Affected versions
All versions when installed via some package managers
Fixed in: 0.13.3
Details
Are you affected?
Run `openclaw config show | grep debug`
If debug is enabled, you may be affected
Check ~/.openclaw/logs/ for unexpected log files
How to fix
Run `openclaw config set debug false`
Delete any existing debug logs from ~/.openclaw/logs/
Update to 0.13.3: `npm update -g openclaw`
Scan your skills for this vulnerability
Use GitOpenClaw to scan any skill, repo, or install command for patterns associated with CVE-2026-31204 and other known vulnerabilities. Free, no account required.
References
- https://koi.security/research/openclaw-debug-disclosure