If you run OpenClaw, there is a security advisory you need to act on right now. CVE-2026-33579 is a privilege escalation flaw in OpenClaw that lets an attacker with the lowest-level access quietly grant themselves full admin control of your instance. It is rated 8.6 HIGH, it was fixed in version 2026.3.28, and if you are on any older version, you are exposed.
This one is different from the ClawHavoc supply-chain attacks making the rounds. Those came from malicious skills and fake packages. This flaw lives in the OpenClaw core itself. No plugins, no marketplace, no user-installed extensions. Just the bare gateway, running as documented.
Here is what the vulnerability does, how to check if you are affected, and the exact steps to lock down your install today.
What CVE-2026-33579 Actually Is
CVE-2026-33579 is an incorrect authorization bug (CWE-863) in the device pairing flow. OpenClaw devices pair with your gateway using scopes, and the highest scope, operator.admin, grants full control: reading connected data sources, exfiltrating credentials, running arbitrary tool calls, and pivoting to other connected services.
The bug is in the /pair approve command. When a user approves a device pairing request, the code fails to forward the caller’s own security scopes into the authorization check. The approval function only sees the request itself, and since operator.admin is a valid scope, the request passes validation. Scope granted.
The intended model is that an approver can only grant scopes they already hold. Because the caller’s scopes are never forwarded, that check never runs. An attacker with the lowest meaningful permission (operator.pairing) can silently approve a pairing request that asks for operator.admin. No secondary exploit. No user interaction beyond the initial pairing step. Result: full instance takeover.
Why This Matters Right Now
OpenClaw has been through a rough security stretch, and this advisory sits on top of it:
- ClawHavoc / NovaStealer: a supply-chain campaign using typosquatted packages and poisoned skills to steal crypto wallets, SSH keys, and cloud credentials. If you have not checked yet, run the 10-minute ClawHavoc self-check.
- ClawJacked: a cross-origin WebSocket flaw that let any website you visit silently take control of a local OpenClaw gateway. Fixed in 2026.2.25.
- CVE-2026-32922: a 9.9 CRITICAL companion flaw fixed in 2026.3.11. Important: patching that one does NOT fix CVE-2026-33579. You need 2026.3.28 or later.
- Exposed instances: security researchers found tens of thousands of publicly accessible OpenClaw gateways, and a large share of exposed instances run without authentication enabled.
In short: if your gateway is reachable by anything other than your own trusted devices, and you are on a version older than 2026.3.28, assume the pairing path is open.
Check 1: What Version Are You On?
The fix shipped in OpenClaw 2026.3.28. Check your version right now:
openclaw --versionIf the output is anything older than 2026.3.28, you are vulnerable. Do not keep using it unpatched. Update before you do anything else:
npm update -g openclawIf you installed via Docker or another method, update through that same channel. After updating, restart your gateway and confirm the new version with openclaw --version.
Check 2: Is Your Gateway Exposed?
This vulnerability is far scarier when your gateway is reachable from outside your machine. OpenClaw binds to localhost by default, which is safe. Problems start when people change the bind address to make the gateway reachable from other devices or the internet, often without enabling authentication.
Check what address your gateway is listening on:
openclaw doctorLook for the gateway bind address in the output and in your config file. If it is anything other than 127.0.0.1 or localhost, your gateway is exposed on your network or the internet. That is a serious risk regardless of version.
Also check whether authentication is actually enforced. If your gateway requires no password or token, anyone who can reach it has access. Fix both of these before anything else: bind to localhost (or a private network with a firewall), and enable a strong password or token.
Check 3: Have You Already Been Exploited?
You cannot easily see a past /pair approve abuse from the outside, so if you were on a vulnerable version, assume the worst and take these steps:
- Revoke all device pairings and re-pair only the devices you actually use. Your gateway should have a command to list and remove paired devices. If yours does not, back up your config, reinstall, and set up pairing fresh.
- Rotate every credential the agent can see: API keys, tokens, passwords stored in skills or environment files. Assume they were readable.
- Review connected accounts: messaging apps, calendars, cloud services. Look for new sessions or devices you did not add, and revoke anything unfamiliar.
- Update to 2026.3.28 or later if you have not already. This is the only fix for the vulnerability itself.
How to Stay Safe Going Forward
The fixes are not complicated, but they need to be habits:
- Keep OpenClaw updated. The last few months have shipped multiple critical and high-severity fixes. Running an old version is the single biggest risk factor.
- Keep the gateway on localhost unless you genuinely need remote access, and if you do, put it behind a firewall and a real authentication requirement, never plain on the open internet.
- Enable and enforce authentication. A password or token is cheap insurance. The exposed instances researchers found were mostly running with no auth at all.
- Audit your devices and scopes periodically. You should be able to see every paired device and its scope. Anything you do not recognize gets revoked.
- Stay skeptical of installs. With the ClawHavoc campaign active, only install skills and plugins from the official registry, and verify package names character by character before running anything.
Bottom Line
CVE-2026-33579 is a real, high-severity privilege escalation with a simple fix: update to 2026.3.28 or later. If you are on an older version, update today. If your gateway is exposed or unauthenticated, fix that too. Ten minutes of work now beats a full instance takeover later.
Just got OpenClaw or thinking about it?
Start from a secure setup so you never have to chase advisories later. The OpenClaw setup guide walks through install, authentication, and the security settings worth turning on from day one.
About The Author
