Openclaw CVE-2026-33575

OpenClaw versions before 2026.3.12. Attacker requires access to leaked setup codes from /pair endpoint or qr command output (via chat history, logs, or screenshots). Victim interaction: setup codes must be exposed in accessible locations. No authentication required to exploit recovered credentials.

Real-world risk is substantial despite requiring user interaction (CVSS UI:A). The CVSS 4.0 score of 8.6 reflects network-based attack vector (AV:N) with low complexity (AC:L) and no privileges required (PR:N), resulting in high confidentiality, integrity, and availability impact on the vulnerable component. The attack is highly practical: pairing codes are routinely shared via insecure channels during legitimate setup workflows (support tickets, Slack messages, email), and users often screenshot QR codes for troubleshooting. Once obtained, the embedded credential grants persistent gateway access beyond the intended one-time pairing window. No EPSS score is available for correlation, and no confirmed active exploitation (not in CISA KEV). However, the vulnerability is trivially exploitable once a pairing code is intercepted-no sophisticated tooling required, just extraction of the embedded credential from the setup token. The SSVC framework would likely classify this as automatable with considerable technical impact given the credential grants full gateway control. Organizations using OpenClaw for production gateway management face significant exposure if pairing codes were shared historically, as past codes remain valid attack vectors.

An employee configures a new OpenClaw gateway and generates a pairing QR code using the qr command. They share a screenshot of the QR code in a company Slack channel to troubleshoot connection issues with a colleague. Three months later, an attacker gains read access to the Slack workspace through a phishing compromise. The attacker extracts archived screenshots from the channel history, decodes the QR pairing code, and recovers the embedded long-lived gateway credential. Using this credential, the attacker authenticates directly to the gateway infrastructure, bypassing the intended one-time pairing restriction, and gains persistent administrative access to the gateway environment with high confidentiality, integrity, and availability impact.