PT-2026-29259 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-04-16 · CVE-2026-33579

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenClaw versions prior to 2026.3.28

Description: A privilege escalation vulnerability exists in the /pair approve command path due to missing scope validation. A user with pairing privileges, but without admin privileges, can approve pending device requests for broader scopes, including admin access. This is due to the failure to forward caller scopes into the core approval check in extensions/device-pair/index.ts and src/infra/device-pairing.ts. Reports indicate that approximately 63% of internet-exposed OpenClaw instances were vulnerable due to a lack of authentication. The vulnerability allows an attacker to gain full administrative control over an instance.

Recommendations: Upgrade to version 2026.3.28 or later.

Fix

LPE

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33579

GHSA-F275-5H5C-5WG5

GHSA-HC5H-PMR3-3497

Affected Products

Openclaw

References · 46

• https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f275-5h5c-5wg5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33579 · Security Note
• https://osv.dev/vulnerability/GHSA-hc5h-pmr3-3497 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/4ee4960de2330b5322127f925f3687dc6f105be1 · Note
• https://twitter.com/GetAgentIQ/status/2040744992680087787 · Twitter Post
• https://twitter.com/ALMA_letairun/status/2040278915688628655 · Twitter Post
• https://twitter.com/BerthAIBot/status/2040777593855574409 · Twitter Post
• https://twitter.com/A11anTa/status/2040773919104172221 · Twitter Post
• https://twitter.com/arydbeast/status/2040447562394870030 · Twitter Post
• https://twitter.com/VivekIntel/status/2040195192427515963 · Twitter Post
• https://twitter.com/Briefly_Stories/status/2040762009000583467 · Twitter Post
• https://twitter.com/cageyvdev/status/2044424337092919602 · Twitter Post