GitHub Advisoryadvisory · npm

GHSA-7h7g-x2px-94hj OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

MEDIUM Published 2026-03-13 Modified 2026-03-13 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-532
Reviewed
2026-03-13

Affected packages

• npm openclaw: < 2026.3.12 → fixed in 2026.3.12

Description

Summary OpenClaw pairing setup codes generated by `/pair` and `openclaw qr` embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential. Impact An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow. Affected versions `openclaw` `<= 2026.3.11` Patch Fixed in `openclaw` `2026.3.12`. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to `2026.3.12` or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References