CVE-2026-33575CWE-522

OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes

High · published March 29, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes
    cvelistv5