CVEvulnerability

CVE-2026-33575

8.6 HIGH Published 2026-03-29 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-03-29
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-522

Description

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

Affected configurations

• openclaw openclaw (< 2026.3.12)

Weakness · CWE (1)

CWE-522 Insufficiently Protected Credentials weakness

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-7h7g-x2px-94hj Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-long-lived-credential-exposure-in-pairing-setup-codes Third Party Advisory

CVE-2026-33575

Description

Affected configurations

Related

Weakness · CWE (1)

References