npm/openclaw CVE-2026-33575: high 7.5, EPSS 0.25%

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

Action: Upgrade openclaw to 2026.3.12 or later.

npm i openclaw@2026.3.12

Affected

Fixed versions

Sources

• osv: GHSA-7h7g-x2px-94hj
• nvd: CVE-2026-33575
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7h7g-x2px-94hj
• https://github.com/openclaw/openclaw
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12

CVE-2026-33575 · published 2026-03-13T20:54:18Z · modified 2026-07-08T08:12:27.720197637Z · JSON