CVE-2026-33577: OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve

Published Mar 31, 2026
·
Updated

Summary

The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node.

Impact

A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node.

Affected Component

src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts

Fixed Versions

- Affected: <= 2026.3.24 - Patched: >= 2026.3.28 - Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 4d7cc6bb4f (gateway: restrict node pairing approvals).

Other sources

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.

MITRE

Affected Software

3 affected componentsFixes available
OpenClaw OpenClaw<2026.3.28
npm/openclaw<=2026.3.24
2026.3.28
OpenClaw Openclaw Node.js<2026.3.28

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/openclaw to a version that resolves this vulnerability.

    Fixed in 2026.3.28
  2. Upgrade

    Upgrade OpenClaw to a version that resolves this vulnerability.

    Fixed in 2026.3.28Patch 4d7cc6bb4f

Event History

Mar 31, 2026
CVE Published
via MITRE·02:10 PM
Data Sourced
via MITRE·02:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 1, 2026
Advisory Published
via GitHub·12:00 AM
Data Sourced
via GitHub·12:00 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-33577?

CVE-2026-33577 is considered a high-severity vulnerability due to its potential for allowing low-privilege users to approve nodes with excessive permissions.

2

How do I fix CVE-2026-33577?

To mitigate CVE-2026-33577, upgrade OpenClaw to version 2026.3.28 or later, where the insufficient scope validation has been addressed.

3

Who is affected by CVE-2026-33577?

Any users of OpenClaw versions prior to 2026.3.28 are affected by CVE-2026-33577 due to the insufficient scope validation in node pairing.

4

What are the potential impacts of exploiting CVE-2026-33577?

Exploitation of CVE-2026-33577 can lead to unauthorized node approvals, allowing attackers to gain broader access and control over the OpenClaw system.

5

Is there a workaround for CVE-2026-33577 before upgrading?

No documented workarounds are provided for CVE-2026-33577; upgrading to the fixed version is the recommended solution.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203