GitHub Advisoryadvisory · npm

GHSA-hc5h-pmr3-3497 OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

CRITICAL Published 2026-03-31 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-33579
Ecosystem
npm
Packages
openclaw
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-863
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary The `/pair approve` command path called device approval without forwarding caller scopes into the core approval check. Impact A caller that held pairing privileges but not admin privileges could approve a pending device request asking for broader scopes, including admin access. Affected Component `extensions/device-pair/index.ts, src/infra/device-pairing.ts` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `4ee4960de2` (`Pairing: forward caller scopes during approval`). OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-33579 OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References