Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-33575
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 1 month ago by @mweinelt Activity log
  • Created suggestion 1 month ago
  • @mweinelt dismissed 1 month ago
OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reuse the shared gateway credential outside the intended one-time pairing flow.

Affected products

OpenClaw
  • ==2026.3.12
  • <2026.3.12

Matching in nixpkgs

Package maintainers

Fixed in https://github.com/nixos/nixpkgs/pull/499141