CVE-2026-33575
Published: 29 March 2026
Summary
CVE-2026-33575 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33575 is a credential exposure vulnerability (CWE-522) affecting OpenClaw versions before 2026.3.12. The issue arises because the software embeds long-lived shared gateway credentials directly into pairing setup codes generated by the /pair endpoint and the OpenClaw qr command. This design flaw allows the credentials to be recoverable from the setup codes, violating the intended one-time-use pairing flow. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with low complexity and no prerequisites for remote exploitation.
Attackers who obtain leaked pairing setup codes—such as from chat histories, logs, or screenshots—can extract the embedded shared gateway credentials and reuse them outside the legitimate pairing process. No authentication, privileges, or user interaction are required, enabling unauthenticated remote attackers to compromise gateway access. Successful exploitation grants unauthorized access to the gateway, potentially leading to further network compromise depending on the gateway's role.
Advisories from the OpenClaw GitHub security page (GHSA-7h7g-x2px-94hj) and VulnCheck detail the issue and recommend upgrading to OpenClaw 2026.3.12 or later, where the pairing setup codes no longer embed the long-lived credentials. Practitioners should audit logs, chat histories, and any stored QR codes for exposure and rotate affected gateway credentials immediately.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17029
Vulnerability details
OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared…
more
gateway credential outside the intended one-time pairing flow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly exposes long-lived credentials embedded in recoverable pairing/QR codes (logs, chat, screenshots), enabling T1552 Unsecured Credentials retrieval and reuse for gateway access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires protecting authenticator content from unauthorized disclosure and modification, directly preventing the embedding of long-lived shared gateway credentials in recoverable pairing setup codes.
Mandates identification, reporting, and remediation of flaws like the credential embedding in OpenClaw pairing codes, enabling upgrades to non-vulnerable versions.
Supports review, disabling, and rotation of compromised shared gateway credentials exposed via leaked setup codes from logs, chats, or screenshots.