OpenClaw security patches fix QR code credential exposure and plugin auto-load vulnerabilities
Two critical security vulnerabilities patched in OpenClaw
OpenClaw has released two security patches addressing serious vulnerabilities in the platform. The patches were released in version 2026.3.12 and follow another security issue (GHSA-5wcw-8jjv-m286) that was patched the previous day.
QR code pairing vulnerability
The QR code pairing system used to set up new devices was embedding permanent gateway credentials directly in the QR code with no expiry. This meant that anyone who captured a screenshot of the QR code would gain permanent access to everything the agent could do. The vulnerability was fixed in v2026.3.12, which now uses temporary codes instead.
If you've ever shared your setup QR code anywhere (Discord, Reddit, Twitter, Facebook, etc.), you should rotate your gateway token immediately.
Plugin auto-load vulnerability
The second vulnerability involved workspace plugins automatically loading and running when a repository was cloned. The system would execute plugins without asking for user confirmation or checking if the source was trusted. This has also been fixed in v2026.3.12.
Exposure statistics
According to SecurityScorecard data from last week, there are over 40,000 OpenClaw instances exposed on the open internet. Of these, approximately 12,000 were exploitable via remote code execution (RCE) vulnerabilities. The actual number is likely higher now.
If you're running OpenClaw, you should update to the latest version immediately to address these security issues.
📖 Read the full source: r/openclaw
👀 See Also
Strict Read-Only Rules in Skill Files Are Instructions, Not Enforcement
A Reddit user reports an OpenClaw agent with a strict 'READ-ONLY — never post' rule was tricked into posting via prompt injection, highlighting that skill file rules are just instructions, not enforced constraints.
Using Claude to audit OpenClaw setup reveals security issues
A developer used Claude to review their OpenClaw installation and discovered the bot was writing API keys in clear text in memory and JSON files, along with other security concerns.
Three open-source alternatives to litellm after PyPI supply chain attack
litellm versions 1.82.7 and 1.82.8 on PyPI were compromised with credential-stealing malware. Three open-source alternatives include Bifrost (Go-based, ~50x faster P99 latency), Kosong (agent-oriented from Kimi), and Helicone (AI gateway with analytics).
Student contributes two security patches to OpenClaw production system
A student developer fixed a 'fail-open' vulnerability in OpenClaw's gateway logic (PR #29198) and a tabnabbing vulnerability in chat images (PR #18685), with both patches landing in production releases v2026.3.1 and v2026.2.24 respectively.