PT-2026-27288 · Npm · Openclaw

Publicado 2026-03-13 · Atualizado 2026-03-13

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

OpenClaw pairing setup codes generated by /pair and openclaw qr embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential.

Impact

An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to 2026.3.12 or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

GHSA-7H7G-X2PX-94HJ

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7h7g-x2px-94hj · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Nota
• https://osv.dev/vulnerability/GHSA-7h7g-x2px-94hj · Aviso do Fabricante