Is CVE-2026-33579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33579 being exploited in the wild.

How severe is CVE-2026-33579?

Critical severity, with a CVSS score of 9.9, published 31 March 2026.

Which products and versions are affected?

openclaw (npm) SEMVER:introduced=0,fixed=2026.3.28; Openclaw < 2026.3.28.

Is there a fix for CVE-2026-33579?

Yes. openclaw (npm): upgrade to 2026.3.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33579 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33579?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33579: OpenClaw privilege escalation in device pairing approval

Q: Is there a fix for CVE-2026-33579?

Yes. openclaw (npm): upgrade to 2026.3.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33579 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33579?

Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33579 · Severity: critical · CVSS 9.9 · Published 2026-03-31

OpenClaw, a platform for device management and pairing, contains a security flaw that allows users with limited permissions to grant themselves full administrative access. By exploiting a weakness in how device pairing requests are approved, a standard user can authorize new devices with high-level system privileges they should not possess. This could lead to a complete takeover of the platform, unauthorized data access, and disruption of operations.

Technologies: openclaw (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-33579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33579 being exploited in the wild.
How severe is CVE-2026-33579?: Critical severity, with a CVSS score of 9.9, published 31 March 2026.
Which products and versions are affected?: openclaw (npm) SEMVER:introduced=0,fixed=2026.3.28; Openclaw < 2026.3.28.
Is there a fix for CVE-2026-33579?: Yes. openclaw (npm): upgrade to 2026.3.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33579 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33579?: Check whether you run openclaw (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openclaw (npm): upgrade to 2026.3.28 or later
```
npm install openclaw@2026.3.28
```

Technical details

A privilege escalation vulnerability exists in OpenClaw's device pairing approval workflow due to incorrect authorization (CWE-863). The root cause is located in 'extensions/device-pair/index.ts' and 'src/infra/device-pairing.ts', where the '/pair approve' command path fails to validate that the approving user's own permission scopes are sufficient to grant the scopes requested by a pending device. An attacker with low-level 'pairing' privileges can approve device requests for 'admin' or other elevated scopes. This allows a network-based attacker with valid credentials to escalate their privileges to full administrative control. The issue is resolved in version 2026.3.28.

Affected products

OpenClaw OpenClaw < 2026.3.28

Identifiers

CVE-2026-33579
GHSA-hc5h-pmr3-3497

Timeline

2026-03-29: advisory: Vendor advisory GHSA-hc5h-pmr3-3497 published
2026-03-31: disclosed: CVE-2026-33579 published to NVD
2026-03-31: patched: Fix released in version 2026.3.28

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.