https://nvd.nist.gov/vuln/detail/CVE-2026-33579 You are viewing this page in an unauthorized frame window. This is a potential security issue, you are being redirected to https://nvd.nist.gov You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality. U.S. flag An official website of the United States government Here's how you know Dot gov Official websites use .gov A .gov website belongs to an official government organization in the United States. Https Secure .gov websites use HTTPS A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. National Institute of Standards and Technology NVD MENU * General Expand or Collapse NVD Dashboard News and Status Updates FAQ Visualizations Legal Disclaimer * Vulnerabilities Expand or Collapse Search & Statistics Weakness Types Data Feeds Vendor Comments CVMAP * Vulnerability Metrics Expand or Collapse CVSS v4.0 Calculators CVSS v3.x Calculators CVSS v2.0 Calculator * Products Expand or Collapse CPE Dictionary CPE Search CPE Statistics SWID * Developers Expand or Collapse Start Here Request an API Key Vulnerabilities Products Data Sources Terms of Use * Contact NVD * Other Sites Expand or Collapse Checklist (NCP) Repository Configurations (CCE) 800-53 Controls SCAP * Search Expand or Collapse Vulnerability Search CPE Search Information Technology Laboratory National Vulnerability Database National Vulnerability Database NVD National Vulnerability Database 1. Vulnerabilities CVE-2026-33579 Detail Description OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/ index.ts and src/infra/device-pairing.ts. Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 4.0 Severity and Vector Strings: NIST CVSS score NIST: NVD N/A NVD assessment not yet provided. Nist CVSS score does not match with CNA score CNA: VulnCheck CVSS-B 8.6 HIGH Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/ SA:N CVSS 3.x Severity and Vector Strings: Nist CVSS score does not match with CNA score CNA: VulnCheck Base Score: 8.1 HIGH Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS 2.0 Severity and Vector Strings: National Institute of Standards and Technology NIST: NVD Base Score: N/A NVD assessment not yet provided. References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected]. URL Source(s) Tag(s) https://github.com/openclaw/openclaw/commit/ VulnCheck Patch e403decb6e20091b5402780a7ccd2085f98aa3cd https://github.com/openclaw/openclaw/security/advisories/ VulnCheck Vendor GHSA-hc5h-pmr3-3497 Advisory https://www.vulncheck.com/advisories/ Third openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval VulnCheck Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-863 Incorrect Authorization VulnCheck Known Affected Software Configurations Switch to CPE 2.2 CPEs loading, please wait. Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Initial Analysis by NIST 4/01/2026 3:07:04 PM Action Type Old New Value Value OR CPE *cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* versions up to (excluding) 2026.3.28 Added Configuration VulnCheck: https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd Types: Patch Added Reference Type VulnCheck: https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497 Types: Vendor Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval Types: Third Party Advisory Added Reference Type CVE Modified by VulnCheck 3/31/2026 2:16:54 PM Action Type Old Value New Value AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CVSS V3.1 New CVE Received from VulnCheck 3/31/2026 11:16:14 AM Action Type Old New Value Value OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts. Added Description AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V4.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CVSS V3.1 CWE-863 Added CWE https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd Added Reference https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497 Added Reference https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval Added Reference Quick Info CVE Dictionary Entry: CVE-2026-33579 NVD Published Date: 03/31/2026 NVD Last Modified: 04/01/2026 Source: VulnCheck * X (link is external) * facebook (link is external) * linkedin (link is external) * youtube (link is external) * rss * govdelivery (link is external) National Institute of Standards and Technology logo National Institute of Standards and Technology logo HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 (301) 975-2000 Webmaster | Contact Us | Our Other Offices Incident Response Assistance and Non-NVD Related Technical Cyber Security Questions: US-CERT Security Operations Center Email: [email protected] Phone: 1-888-282-0870 Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov