CVE-2026-33575: OpenClaw gateway credential exposed

CISO Take

OpenClaw before 2026.3.12 embeds long-lived, reusable gateway credentials directly inside the pairing setup codes generated by the /pair endpoint and the 'openclaw qr' command, meaning any screenshot, Slack message, ticket, or screen recording that captured a setup code during device onboarding also captured a working gateway credential. With CVSS 7.5 and AV:N/AC:L/PR:N/UI:N, no authentication, special privileges, or user interaction are required once an attacker locates a leaked code — and EPSS places this in the top 84% of CVEs by exploitation likelihood. As an AI agent platform with tool invocation capabilities, a compromised gateway exposes not just the agent session but every downstream tool and data source it connects to, making blast radius contingent on what the agent is authorised to touch. Upgrade to OpenClaw 2026.3.12 immediately, rotate all gateway credentials issued under prior versions, and audit collaboration platforms for historical pairing codes.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High risk for organisations running OpenClaw as an AI agent gateway. The vulnerability demands no exploitation skill — decoding a leaked pairing code and replaying the embedded credential requires only basic tooling. The long-lived nature of the credential means exposure is persistent and silent until the credential is explicitly rotated. EPSS at the 84th percentile reflects the low technical barrier; the main attacker precondition is locating a setup code, but in enterprise environments where QR codes are shared via helpdesk screenshots, onboarding guides, or Slack DMs, this bar is low. Risk is partially mitigated by the currently small install base (4 downstream dependents) and the absence of public exploit code or KEV listing, but the trivial exploitation path warrants urgent remediation for any active deployment.

How does the attack unfold?

Setup Code Discovery

Attacker locates a leaked OpenClaw pairing setup code — as a QR image or raw token — from chat logs, IT screenshots, support tickets, or screen recordings shared during device onboarding.

AML.T0036

Credential Extraction

Attacker decodes the pairing setup code using standard tooling and extracts the embedded long-lived gateway credential that was intended only for one-time pairing use.

AML.T0055

Gateway Authentication

Attacker presents the extracted credential directly to the OpenClaw gateway API, successfully authenticating as a valid client outside the intended pairing flow with no additional privileges or interaction required.

AML.T0012

AI Agent Abuse

Attacker invokes the authenticated AI agent's available tools and connected data sources, potentially exfiltrating files, querying internal APIs, or persisting within the agent framework across multiple sessions.

AML.T0053

Setup Code Discovery

Attacker locates a leaked OpenClaw pairing setup code — as a QR image or raw token — from chat logs, IT screenshots, support tickets, or screen recordings shared during device onboarding.

AML.T0036

Credential Extraction

Attacker decodes the pairing setup code using standard tooling and extracts the embedded long-lived gateway credential that was intended only for one-time pairing use.

AML.T0055

Gateway Authentication

Attacker presents the extracted credential directly to the OpenClaw gateway API, successfully authenticating as a valid client outside the intended pairing flow with no additional privileges or interaction required.

AML.T0012

AI Agent Abuse

Attacker invokes the authenticated AI agent's available tools and connected data sources, potentially exfiltrating files, querying internal APIs, or persisting within the agent framework across multiple sessions.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

6 steps

Upgrade OpenClaw to version 2026.3.12 or later — this release eliminates the embedding of reusable credentials in pairing codes.
Rotate all gateway credentials previously generated by the /pair endpoint or 'openclaw qr' command on any version prior to 2026.3.12; treat all previously issued setup codes as permanently compromised.
Search collaboration platforms (Slack, Teams, Jira, Confluence, email archives, screen recording repositories) for strings or images matching OpenClaw QR payload patterns to scope exposure.
Review OpenClaw gateway access logs for authentication events that do not correspond to known paired devices or that occur outside expected geographic and temporal patterns.
Where feasible, restrict gateway API access to allowlisted IP ranges or VPN egress to reduce exploitability even if credentials have leaked.
Mandate short-lived, single-use tokens for all future agent pairing flows and document this as a hardening requirement in AI agent deployment standards.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.1 - Data protection policies for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to respond to and recover from AI risks

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-33575?

OpenClaw before 2026.3.12 embeds long-lived, reusable gateway credentials directly inside the pairing setup codes generated by the /pair endpoint and the 'openclaw qr' command, meaning any screenshot, Slack message, ticket, or screen recording that captured a setup code during device onboarding also captured a working gateway credential. With CVSS 7.5 and AV:N/AC:L/PR:N/UI:N, no authentication, special privileges, or user interaction are required once an attacker locates a leaked code — and EPSS places this in the top 84% of CVEs by exploitation likelihood. As an AI agent platform with tool invocation capabilities, a compromised gateway exposes not just the agent session but every downstream tool and data source it connects to, making blast radius contingent on what the agent is authorised to touch. Upgrade to OpenClaw 2026.3.12 immediately, rotate all gateway credentials issued under prior versions, and audit collaboration platforms for historical pairing codes.

Is CVE-2026-33575 actively exploited?

No confirmed active exploitation of CVE-2026-33575 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33575?

1. Upgrade OpenClaw to version 2026.3.12 or later — this release eliminates the embedding of reusable credentials in pairing codes. 2. Rotate all gateway credentials previously generated by the /pair endpoint or 'openclaw qr' command on any version prior to 2026.3.12; treat all previously issued setup codes as permanently compromised. 3. Search collaboration platforms (Slack, Teams, Jira, Confluence, email archives, screen recording repositories) for strings or images matching OpenClaw QR payload patterns to scope exposure. 4. Review OpenClaw gateway access logs for authentication events that do not correspond to known paired devices or that occur outside expected geographic and temporal patterns. 5. Where feasible, restrict gateway API access to allowlisted IP ranges or VPN egress to reduce exploitability even if credentials have leaked. 6. Mandate short-lived, single-use tokens for all future agent pairing flows and document this as a hardening requirement in AI agent deployment standards.

What systems are affected by CVE-2026-33575?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI gateway integrations, multi-device AI agent deployments, enterprise AI agent onboarding pipelines.

What is the CVSS score for CVE-2026-33575?

CVE-2026-33575 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI gateway integrationsmulti-device AI agent deploymentsenterprise AI agent onboarding pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

Exploitation Scenario

An attacker conducting reconnaissance against an organisation's AI agent stack discovers through OSINT that the organisation uses OpenClaw for internal agent deployment. They search internal communication leaks or target a low-privilege employee via phishing to access their Slack history. In the IT helpdesk channel, they find a screenshot shared months earlier during a new-device onboarding session showing the OpenClaw QR code in plaintext. They decode the QR image using a standard QR scanner and extract the embedded gateway credential. Using a standard HTTP client, they present that credential to the OpenClaw gateway API — authenticating as a valid client with no additional barriers. Once inside, they enumerate the AI agent's configured tools, identify a connection to an internal document store, and invoke the tool to exfiltrate sensitive project files over multiple sessions. The access persists undetected until the credential is rotated, which may never occur if the organisation is unaware of this CVE.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.