CVE-2026-33579 in OpenClaw
Sumário (Inglês)
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.
Responsável
VulnCheck
Reservar
23/03/2026
Divulgação
31/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354404 | OpenClaw Elevação de Privilégios | 863 | Não definido | Correção oficial | CVE-2026-33579 |