What is CVE-2026-33575?

CVE-2026-33575 is a high-severity vulnerability in Openclaw, classified under Insufficiently Protected Credentials. CVSS score: 7.5/10. Published 2026-03-29.

How severe is CVE-2026-33575?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Openclaw

CVE-2026-33575

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Openclaw — versions 0, 2026.3.12

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

disclosure@vulncheck.com (vendor-advisory, Vendor Advisory, third-party-advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-33575?: CVE-2026-33575 is a high-severity vulnerability in Openclaw, classified under Insufficiently Protected Credentials. CVSS score: 7.5/10. Published 2026-03-29.
How severe is CVE-2026-33575?: High severity. CVSS v3 base score is 7.5 out of 10.