OpenClaw releases before 2026.3.12 embed long‑lived shared gateway credentials directly into pairing setup codes generated by the /pair endpoint and the qr command. When these codes are shared through chat history, logs, or screenshots, an attacker can recover and reuse the shared gateway credential beyond the intended one‑time pairing flow. The compromised credential grants unauthorized access to the gateway, potentially allowing an attacker to intercept, manipulate, or take complete control of network traffic and connected devices. This vulnerability is categorized as CWE‑522, an information‑exposure weakness.

The affected systems are deployments of OpenClaw, specifically any installation using a version earlier than 2026.3.12. The issue manifests in all OpenClaw platforms that generate pairing codes via the /pair endpoint or the qr command.

The CVSS score of 8.6 indicates high severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker obtaining a leaked pairing code from user-facing channels such as chat, logs, or screenshots; from that, the attacker can extract the shared gateway credential and reuse it. Given the possibility of code leakage, the risk remains high if systems are exposed to social or logging channels.