OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-532.
Summary
### Summary OpenClaw pairing setup codes generated by `/pair` and `openclaw qr` embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential. ### Impact An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to `2026.3.12` or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openclaw (npm) | before 2026.3.12 | 2026.3.12 | Patch available | GHSA-7h7g-x2px-94hj |
- openclaw (npm) Vendor— Affected before 2026.3.12 Fixed in 2026.3.12 Patch available GHSA-7h7g-x2px-94hj
Remediation
- Fix · GHSA-7h7g-x2px-94hj openclaw (npm) Fixed in 2026.3.12 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-7h7g-x2px-94hj
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences