{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-33579",
    "name": "CVE-2026-33579",
    "vendor": "OpenClaw",
    "description": "OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pairing access to silently approve device pairings that granted full admin control. With 135,000+ publicly exposed instances and 63% running with no authentication at all, this was one of March 2026's most critical AI-framework disclosures; patched in OpenClaw 2026.3.28.",
    "website": "https://www.cvedetails.com/cve/CVE-2026-33579",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-03-29",
    "risk": {
      "score": 98,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-33579",
      "aliases": [
        "ti-002"
      ],
      "title": "CVE-2026-33579: OpenClaw Privilege Escalation via /pair approve (CVSS 9.8)",
      "summary": "OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pairing access to silently approve device pairings that granted full admin control. With 135,000+ publicly exposed instances and 63% running with no authentication at all, this was one of March 2026's most critical AI-framework disclosures; patched in OpenClaw 2026.3.28.",
      "severity": "critical",
      "cvss": {
        "score": 9.8,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Privilege escalation"
      ],
      "componentType": "agent",
      "component": {
        "name": "OpenClaw",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "OpenClaw < 2026.3.28",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-03-29",
      "modifiedAt": "2026-03-29",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://www.cvedetails.com/cve/CVE-2026-33579"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33579"
        }
      ],
      "mitigation": "Upgrade to OpenClaw 2026.3.28+. Enable authentication on all OpenClaw instances. Review pairing approvals for unauthorized elevations. Restrict operator.pairing scope to trusted admins only.",
      "detectedByAnomity": true
    }
  }
}