# CVE-2026-33579: CVE-2026-33579: OpenClaw Privilege Escalation via /pair approve (CVSS 9.8)

> CVE-2026-33579 is a critical-severity privilege escalation issue (CVSS 9.8) in OpenClaw, an AI agent. Affected: OpenClaw < 2026.3.28.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-33579
- **Aliases:** ti-002
- **Severity:** critical
- **CVSS:** 9.8
- **Attack type:** Privilege escalation
- **Component:** OpenClaw (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-03-29
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-33579

## Summary

OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pairing access to silently approve device pairings that granted full admin control. With 135,000+ publicly exposed instances and 63% running with no authentication at all, this was one of March 2026's most critical AI-framework disclosures; patched in OpenClaw 2026.3.28.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| OpenClaw < 2026.3.28 | no fixed version listed |

## Am I affected by CVE-2026-33579?

You are affected if you run OpenClaw < 2026.3.28.

## How do I fix CVE-2026-33579?

Upgrade to OpenClaw 2026.3.28+. Enable authentication on all OpenClaw instances. Review pairing approvals for unauthorized elevations. Restrict operator.pairing scope to trusted admins only.

## How do I find every machine running OpenClaw?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run OpenClaw and which version, then enforce a policy on it.

## References

- cve: https://www.cvedetails.com/cve/CVE-2026-33579
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-33579

## Related vulnerabilities

- [CVE-2026-44112](https://catalog.anomity.ai/vuln/cve-2026-44112) — high
- [openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and](https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and) — high
- [CVE-2026-18830](https://catalog.anomity.ai/vuln/cve-2026-18830) — high
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [CVE-2026-46331](https://catalog.anomity.ai/vuln/cve-2026-46331) — high
- [CVE-2026-35435](https://catalog.anomity.ai/vuln/cve-2026-35435) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-33579