CVE-2026-33579
Published: 31 March 2026
Summary
CVE-2026-33579 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Openclaw Openclaw. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33579 is a privilege escalation vulnerability in OpenClaw versions before 2026.3.28. The flaw occurs in the /pair approve command path, which fails to forward caller scopes into the core approval check due to missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts. It has been classified under CWE-863 (Incorrect Authorization) with a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and was published on 2026-03-31.
A remote attacker with low privileges, specifically pairing privileges but without admin access, can exploit this vulnerability to approve pending device pairing requests that demand broader scopes, including admin privileges. This enables full privilege escalation, granting high-impact confidentiality, integrity, and availability compromise across a changed scope with low attack complexity and no user interaction.
Mitigation is addressed in OpenClaw 2026.3.28 via a patch in commit e403decb6e20091b5402780a7ccd2085f98aa3cd, as detailed in the GitHub security advisory GHSA-hc5h-pmr3-3497 and the VulnCheck advisory on the privilege escalation via missing caller scope validation in device pair approval.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17437
Vulnerability details
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking…
more
for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Explicit privilege escalation vulnerability via missing scope validation and incorrect authorization (CWE-863) in device pairing approval, allowing low-privileged attackers to gain admin-level access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the failure to enforce caller scopes in the device pairing approval path, preventing unauthorized privilege escalation.
Enforces least privilege to restrict pairing users from approving admin scopes, limiting escalation potential despite flawed enforcement.
Requires timely remediation of the specific code flaw in extensions/device-pair/index.ts and src/infra/device-pairing.ts via patching as done in OpenClaw 2026.3.28.