Vulnerability intelligence

CVE-2026-33579

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

CVSS Score

8.6

High

EPSS — Exploit Probability

0.8%

Riskier than 55% of all CVEs · checked 2026-09-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published