CVE-2026-33577: OpenClaw scope bypass lets low-priv

CISO Take

CVE-2026-33577 is an authorization bypass in OpenClaw's node-pairing approval workflow where missing callerScopes validation in node-pairing.ts allows a low-privilege operator to approve node connections carrying scopes that exceed their own authorization level. In AI agent platforms, scope escalation translates directly to unauthorized tool invocation, API access, and data pipeline exposure — the blast radius scales with the privilege level of the targeted node. While not yet in CISA KEV and no public exploit has been published, EPSS places this in the top 70% for exploitation likelihood, and OpenClaw's ecosystem has already surfaced an active credential-stealing skills abuse campaign (AIID #1368), making this a credible escalation path for insider threats or compromised low-privilege accounts. Patch immediately to OpenClaw 2026.3.28 or restrict node-pairing approvals to administrator-only accounts as an interim control, and audit all existing node pairings for scope anomalies.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High. The attack profile is near-optimal for exploitation: network-accessible, low complexity, low privilege requirements, and no user interaction needed. In AI agent frameworks, unchecked scope escalation silently extends attacker reach into orchestration layers, tool APIs, and integrated data sources without triggering traditional access control alerts. The existing AIID #1368 incident confirms OpenClaw's privilege model is already under adversarial scrutiny, increasing the probability this vector will be actively targeted once the advisory is widely read.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw with valid low-privilege operator credentials obtained via credential stuffing, phishing, or insider access.

AML.T0012

Exploitation

Attacker submits a node-pairing approval request targeting a high-scope node; missing callerScopes validation in node-pairing.ts allows the approval to succeed without verifying the operator's own scope level.

AML.T0049

Privilege Escalation

The attacker's session is now associated with the elevated-scope node, granting persistent access to agent tools, APIs, and data pipelines configured for privileged roles.

AML.T0081

Impact

Attacker invokes privileged agent tools to exfiltrate sensitive data, manipulate AI workflows, or pivot to connected systems beyond their original authorization boundary.

AML.T0053

Initial Access

Attacker authenticates to OpenClaw with valid low-privilege operator credentials obtained via credential stuffing, phishing, or insider access.

AML.T0012

Exploitation

Attacker submits a node-pairing approval request targeting a high-scope node; missing callerScopes validation in node-pairing.ts allows the approval to succeed without verifying the operator's own scope level.

AML.T0049

Privilege Escalation

The attacker's session is now associated with the elevated-scope node, granting persistent access to agent tools, APIs, and data pipelines configured for privileged roles.

AML.T0081

Impact

Attacker invokes privileged agent tools to exfiltrate sensitive data, manipulate AI workflows, or pivot to connected systems beyond their original authorization boundary.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

5 steps

Patch to OpenClaw ≥2026.3.28 immediately (patch commit: 4d7cc6bb4fac68b5a5fadd1c5a23168281221f34).
As an interim control, restrict node-pairing approval capability to administrator-level accounts only — revoke this permission from all low-privilege operator roles in RBAC configuration.
Audit all existing node pairings: verify that approved node scopes do not exceed the approving operator's authorization level at time of approval.
Review server-side logs for node-pairing approval events from non-admin accounts over the 90 days prior to patching; treat any anomalies as confirmed exploitation.
Enable alerting on node-pairing approvals from non-administrator operators. No published workaround eliminates the vulnerability without patching.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.4 - AI system access control

NIST AI RMF

GOVERN 1.2 - Accountability structures for AI risk

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33577?

CVE-2026-33577 is an authorization bypass in OpenClaw's node-pairing approval workflow where missing callerScopes validation in node-pairing.ts allows a low-privilege operator to approve node connections carrying scopes that exceed their own authorization level. In AI agent platforms, scope escalation translates directly to unauthorized tool invocation, API access, and data pipeline exposure — the blast radius scales with the privilege level of the targeted node. While not yet in CISA KEV and no public exploit has been published, EPSS places this in the top 70% for exploitation likelihood, and OpenClaw's ecosystem has already surfaced an active credential-stealing skills abuse campaign (AIID #1368), making this a credible escalation path for insider threats or compromised low-privilege accounts. Patch immediately to OpenClaw 2026.3.28 or restrict node-pairing approvals to administrator-only accounts as an interim control, and audit all existing node pairings for scope anomalies.

Is CVE-2026-33577 actively exploited?

No confirmed active exploitation of CVE-2026-33577 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33577?

1. Patch to OpenClaw ≥2026.3.28 immediately (patch commit: 4d7cc6bb4fac68b5a5fadd1c5a23168281221f34). 2. As an interim control, restrict node-pairing approval capability to administrator-level accounts only — revoke this permission from all low-privilege operator roles in RBAC configuration. 3. Audit all existing node pairings: verify that approved node scopes do not exceed the approving operator's authorization level at time of approval. 4. Review server-side logs for node-pairing approval events from non-admin accounts over the 90 days prior to patching; treat any anomalies as confirmed exploitation. 5. Enable alerting on node-pairing approvals from non-administrator operators. No published workaround eliminates the vulnerability without patching.

What systems are affected by CVE-2026-33577?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration, multi-tenant AI deployments, multi-operator AI platforms.

What is the CVSS score for CVE-2026-33577?

CVE-2026-33577 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestrationmulti-tenant AI deploymentsmulti-operator AI platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.4

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.

Exploitation Scenario

An internal low-privilege operator — or an external attacker who has compromised a low-privilege OpenClaw account via credential stuffing or phishing — submits a node-pairing approval request targeting a node configured with administrative or cross-tenant scopes. Because node-pairing.ts skips callerScopes validation, the server does not verify whether the approving operator's own scope level permits authorizing the requested node scope. The pairing succeeds, and the attacker's session now operates with the elevated node's permissions. In a multi-tenant AI agent SaaS deployment, this could mean invoking privileged database connectors, cross-tenant API clients, or administrative workflow functions — all without escalating through a second authentication factor or triggering role-change audit events.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.