8.6 HighCWE-863
CVE-2026-33579
OpenClaw vulnerability
Status
- Not in CISA KEV
- Fixed in version 2026.3.28
- Associated threat actor: UNC6353
Exploit probabilityEPSSchecked 25 Oct
0.8%probability of exploitation in the next 30 days
Higher than 57% of scored CVEs
SeverityCVSS
8.6High
Description NVD
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 3 Apr · 21:01 UTC | Ars Technica | OpenClaw CVE-2026-33579 flaw lets attackers hijack admin rights |
| Mon 6 Apr · 21:11 UTC | dti.domaintools.com | Linux Clipboard Malware Steals Crypto Payments, Researchers Warn |
- Linux Clipboard Malware Steals Crypto Payments, Researchers Warndti.domaintools.com
- OpenClaw CVE-2026-33579 flaw lets attackers hijack admin rightsArs Technica · first in our coverage