VulnSocial

CVE-2026-33575Disclosure(openclaw / openclaw)

LOWCVSS 8.6 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

openclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-522

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-29: 2Technical Details · 2026-03-29: 103-29
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVEFind.com@CveFindCom
    General

    [CVE-2026-33575: HIGH] Beware of the security risk in OpenClaw before 03/12/2026! Leaked setup codes can expose credentials, enabling attackers to misuse them. Stay vigilant against cyber threats.#cve,CVE-2026-33575,#cybersecurity https://cvefind.com/CVE-2026-33575

    Post summary

    The tweet briefly alerts to CVE‑2026‑33575, noting leaked setup codes that could expose credentials, but provides no technical depth, proof‑of‑concept, exploit or patch information.

    0000152
    617 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33575 OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers … https://www.cve.org/CVERecord?id=CVE-2026-33575

    Post summary

    The CVE reveals that OpenClaw embeds long‑lived shared gateway credentials in its pairing codes, exposing authentication data; no PoC, exploit, or patch is mentioned.

    0000053
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities