PT-2026-27288 · Npm · Openclaw

Published 2026-03-13 · Updated 2026-03-13

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

OpenClaw pairing setup codes generated by /pair and openclaw qr embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential.

Impact

An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to 2026.3.12 or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

GHSA-7H7G-X2PX-94HJ

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-7h7g-x2px-94hj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7h7g-x2px-94hj · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Note