CVE-2026-33579: OpenClaw scope bypass escalates

CISO Take

A CVSS 9.9 authorization flaw in OpenClaw (CVE-2026-33579) allows any user with device pairing privileges to approve pending device requests at admin scope by exploiting missing caller-scope forwarding in the /pair approve command path — no admin credentials required. With a network attack vector, low complexity, and no user interaction, the CVSS Scope:Changed modifier reflects that a single compromised pairing account can cascade into full admin control over everything the agent orchestrates, including connected AI tools, configuration surfaces, and restricted data sources. EPSS places this in the top 55% for exploitation likelihood, and the public patch commit (e403decb) is trivially reversible into a working PoC; OpenClaw's ecosystem has already been abused for credential theft at scale (AIID #1368), making rapid weaponization plausible. Upgrade to OpenClaw ≥ 2026.3.28 immediately, audit /pair approve logs for any approvals executed by non-admin accounts, and revoke affected device pairs.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Critical risk. CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H sits at the highest practical severity band for a privilege escalation — network-reachable, trivially exploitable with any low-privilege account, and producing full admin impact with scope change across dependent components. EPSS 0.00624 (top 55%) combined with a public, human-readable patch diff narrows the window before PoC code surfaces. No CISA KEV entry yet, but the low attack complexity and severity of impact make this a strong candidate for near-term weaponization. AI agent orchestration platforms are especially high-value targets because admin access unlocks tool invocation, configuration modification, and lateral movement across every system the agent connects to.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw using a valid low-privilege account that holds device pairing permissions but not admin role.

AML.T0012

Exploitation

Attacker calls /pair approve on a device request specifying admin-level scopes; missing caller-scope forwarding in extensions/device-pair/index.ts causes the core authorization check in src/infra/device-pairing.ts to approve it without validating the caller's actual privilege level.

AML.T0049

Privilege Escalation

Device credential with admin scope is issued; attacker now controls an admin-privileged device identity within OpenClaw with full configuration and tool access.

AML.T0106

Impact

Attacker invokes privileged agent tools, modifies agent configurations, accesses restricted data sources, and pivots to downstream systems the OpenClaw agent orchestrates — all under an admin identity.

AML.T0053

Initial Access

Attacker authenticates to OpenClaw using a valid low-privilege account that holds device pairing permissions but not admin role.

AML.T0012

Exploitation

Attacker calls /pair approve on a device request specifying admin-level scopes; missing caller-scope forwarding in extensions/device-pair/index.ts causes the core authorization check in src/infra/device-pairing.ts to approve it without validating the caller's actual privilege level.

AML.T0049

Privilege Escalation

Device credential with admin scope is issued; attacker now controls an admin-privileged device identity within OpenClaw with full configuration and tool access.

AML.T0106

Impact

Attacker invokes privileged agent tools, modifies agent configurations, accesses restricted data sources, and pivots to downstream systems the OpenClaw agent orchestrates — all under an admin identity.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade to OpenClaw ≥ 2026.3.28 (commit e403decb).
Audit device pairing logs: identify all /pair approve events executed by accounts without admin scope — treat any match as a confirmed compromise indicator.
Revoke suspect device pairs: revoke and re-issue any device credentials approved by non-admin accounts since the last known-good state.
Restrict pairing privileges: apply least-privilege — only accounts that genuinely require device approval should hold pairing permissions.
Detection: add SIEM/EDR rule alerting on /pair approve calls from non-admin principals.
If patching is delayed, temporarily disable device pairing functionality or restrict it to admin-only accounts as a compensating control.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33579?

A CVSS 9.9 authorization flaw in OpenClaw (CVE-2026-33579) allows any user with device pairing privileges to approve pending device requests at admin scope by exploiting missing caller-scope forwarding in the /pair approve command path — no admin credentials required. With a network attack vector, low complexity, and no user interaction, the CVSS Scope:Changed modifier reflects that a single compromised pairing account can cascade into full admin control over everything the agent orchestrates, including connected AI tools, configuration surfaces, and restricted data sources. EPSS places this in the top 55% for exploitation likelihood, and the public patch commit (e403decb) is trivially reversible into a working PoC; OpenClaw's ecosystem has already been abused for credential theft at scale (AIID #1368), making rapid weaponization plausible. Upgrade to OpenClaw ≥ 2026.3.28 immediately, audit /pair approve logs for any approvals executed by non-admin accounts, and revoke affected device pairs.

Is CVE-2026-33579 actively exploited?

No confirmed active exploitation of CVE-2026-33579 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33579?

1. Patch immediately: upgrade to OpenClaw ≥ 2026.3.28 (commit e403decb). 2. Audit device pairing logs: identify all /pair approve events executed by accounts without admin scope — treat any match as a confirmed compromise indicator. 3. Revoke suspect device pairs: revoke and re-issue any device credentials approved by non-admin accounts since the last known-good state. 4. Restrict pairing privileges: apply least-privilege — only accounts that genuinely require device approval should hold pairing permissions. 5. Detection: add SIEM/EDR rule alerting on /pair approve calls from non-admin principals. 6. If patching is delayed, temporarily disable device pairing functionality or restrict it to admin-only accounts as a compensating control.

What systems are affected by CVE-2026-33579?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration platforms, multi-user AI agent deployments, enterprise AI assistant platforms.

What is the CVSS score for CVE-2026-33579?

CVE-2026-33579 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration platformsmulti-user AI agent deploymentsenterprise AI assistant platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

Exploitation Scenario

An attacker with a low-privilege OpenClaw account (e.g., a developer or CI service account holding pairing but not admin role) creates or identifies a pending device pair request that specifies admin-level scopes. They call POST /pair approve with that request ID. Because extensions/device-pair/index.ts fails to forward the caller's scope into the core approval check in src/infra/device-pairing.ts, the authorization gate evaluates the requested scope (admin) rather than the caller's scope (pairing-only) and approves the request. The device is issued admin credentials. The attacker then uses the admin device to modify OpenClaw agent configurations, invoke privileged tools such as file system or API integrations, or extract credentials from connected services — all without ever obtaining a legitimate admin account.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.