CVE-2026-33579

CriticalCVSS 9.9/10Last modified Jul 24, 2026

Description

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	< 2026.3.28

References

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-33585.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all ver CVE-2026-335806.5OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers CVE-2026-335818.6OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by CVE-2026-335826.5Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted CVE-2026-335838.7Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated an CVE-2026-335845.3Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug informati CVE-2026-335853.8Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an CVE-2026-335866.3Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail ser CVE-2026-3358710.0Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on CVE-2026-335888.1Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files CVE-2026-335896.5Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files con CVE-2026-33597.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inpu