CVE-2026-33579

CVE-2026-33579 is a high-severity privilege escalation vulnerability affecting OpenClaw before version 2026.3.28. It allows an attacker with pairing privileges, but without administrative access, to approve device requests for broader scopes, including full administrator access, by exploiting a missing scope validation in the /pair approve command path. With a CVSS score of 8.1, this network-exploitable flaw could lead to complete compromise of confidentiality and integrity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.