CVE-2026-33579 — OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair…¶

Key facts

CVE-2026-33579 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-33579
Severity	Critical (9.9)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-33579/

Details¶

CVE-2026-33579 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-33579
CVSS Score	9.9

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-33579/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-33579

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd
https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497
https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-missing-caller-scope-validation-in-device-pair-approval

Generated by PoC Generator on 2026-04-10T16:04:52.091124535

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-33579, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-33579 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-33579 OpenClaw privilege escalation attempt via /pair approve command"; content:"/pair"; http_uri; content:"approve"; http_uri; distance:0; within:20; content:"POST"; http_method; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-33579 OpenClaw device pairing privilege escalation"; content:"device-pair"; http_uri; content:"approve"; http_uri; content:"admin"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-33579 OpenClaw scope validation bypass attempt"; content:"/pair"; http_uri; content:"approve"; http_uri; content:"scope"; http_client_body; pcre:"/admin|elevated|root/i"; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-33579 OpenClaw pending device approval exploitation"; content:"POST"; http_method; content:"/pair"; http_uri; content:"approve"; http_uri; content:"pending"; http_client_body; content:"device"; http_client_body; distance:0; within:50; classtype:attempted-admin; sid:1000003; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-33579 OpenClaw device-pairing.ts exploitation attempt"; content:"device-pairing"; http_uri; content:"approve"; http_client_body; content:"scope"; http_client_body; pcre:"/\"admin\"|\"root\"|\"elevated\"/i"; classtype:attempted-admin; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_33579_OpenClaw_Privilege_Escalation {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw privilege escalation vulnerability CVE-2026-33579"
        cve = "CVE-2026-33579"
        severity = "high"
        date = "2024-12-19"

    strings:
        $path1 = "extensions/device-pair/index.ts"
        $path2 = "src/infra/device-pairing.ts"
        $cmd1 = "/pair approve" nocase
        $cmd2 = "pair approve" nocase
        $func1 = "approve(" ascii
        $func2 = "devicePairing" ascii
        $scope1 = "admin" ascii
        $scope2 = "pairing" ascii
        $scope3 = "privileges" ascii
        $vuln_pattern1 = /approve\s*\([^)]*\)\s*{[^}]*(?!scope|validation)/
        $vuln_pattern2 = /pair\s+approve[^{]*{(?:[^}](?!scope))*}/
        $openclaw_version = /OpenClaw.*(?:202[0-5]|2026\.[0-2]|2026\.3\.(?:[0-1][0-9]|2[0-7]))/

    condition:
        any of ($path*) or 
        (any of ($cmd*) and any of ($func*) and any of ($scope*)) or
        any of ($vuln_pattern*) or
        $openclaw_version
}

rule CVE_2026_33579_Missing_Scope_Validation {
    meta:
        author = "Security Engineer"
        description = "Detects missing scope validation in OpenClaw device pairing"
        cve = "CVE-2026-33579"
        severity = "high"
        date = "2024-12-19"

    strings:
        $js_func1 = "function approve" ascii
        $js_func2 = "const approve" ascii
        $js_func3 = "export function approve" ascii
        $missing_check1 = { 61 70 70 72 6F 76 65 28 [0-50] 7B [0-100] 7D }
        $missing_check2 = /approve\s*\([^)]*\)\s*\{(?:(?!caller\.scope|validateScope|checkScope|scope\s*=).)*\}/s
        $device_pair = "device-pair" ascii
        $admin_scope = "admin" ascii
        $caller_scope = "caller" ascii

    condition:
        (any of ($js_func*) and $device_pair and $admin_scope) and
        (any of ($missing_check*) or not ($caller_scope))
}

rule CVE_2026_33579_Exploit_Attempt {
    meta:
        author = "Security Engineer"
        description = "Detects potential exploitation of OpenClaw CVE-2026-33579"
        cve = "CVE-2026-33579"
        severity = "critical"
        date = "2024-12-19"

    strings:
        $exploit1 = "/pair approve" nocase
        $exploit2 = "POST /pair" nocase
        $exploit3 = "PUT /pair" nocase
        $payload1 = "admin" ascii
        $payload2 = "scope" ascii
        $payload3 = "privileges" ascii
        $payload4 = "elevation" ascii
        $http_header = "Content-Type: application/json"
        $json_scope = /"scope"\s*:\s*"admin"/
        $json_admin = /"admin"\s*:\s*true/
        $escalation_attempt = /\{"[^"]*":\s*"admin"[^}]*\}/

    condition:
        (any of ($exploit*) and any of ($payload*)) or
        ($http_header and any of ($json*)) or
        $escalation_attempt
}

:material-file-download: prevention/yara.yar

# CVE-2026-33579 Protection - OpenClaw Privilege Escalation Prevention
# Block unauthorized /pair approve command exploitation

# Block direct access to vulnerable pairing endpoints
location ~ ^/pair[/\s]*approve {
    # Block requests that attempt to exploit privilege escalation
    if ($request_method = "POST") {
        return 403;
    }

    # Block requests with suspicious approval parameters
    if ($request_body ~ "admin|Admin|ADMIN") {
        return 403;
    }

    # Block requests attempting to escalate scopes
    if ($request_body ~ "scope.*admin|scope.*elevated|scope.*privilege") {
        return 403;
    }

    # Block requests with malformed approval data
    if ($request_body ~ "approve.*device.*admin|approve.*scope.*admin") {
        return 403;
    }

    return 403;
}

# Block access to vulnerable file paths
location ~ ^/(extensions/device-pair/index\.|src/infra/device-pairing\.) {
    deny all;
    return 404;
}

# Additional protection for pairing-related endpoints
location ~ ^/(api/)?device[s]?[/-]?pair {
    # Rate limiting for pairing requests
    limit_req zone=pairing_limit burst=5 nodelay;

    # Block requests with privilege escalation attempts
    if ($request_body ~ "admin_access|admin_scope|elevated_privileges") {
        return 403;
    }

    # Block requests attempting to bypass scope validation
    if ($request_body ~ "bypass|override|skip.*validation|force.*approve") {
        return 403;
    }

    # Add security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    proxy_pass http://backend;
}

# Rate limiting zone definition (add to http block)
limit_req_zone $binary_remote_addr zone=pairing_limit:10m rate=10r/m;

# Block suspicious User-Agent strings targeting OpenClaw
location / {
    if ($http_user_agent ~ "OpenClaw|device.pair|privilege.escalation") {
        return 403;
    }

    # Block requests with suspicious headers indicating exploitation attempts
    if ($http_x_requested_with ~ "pair|approve|admin") {
        return 403;
    }

    # Continue normal processing
    try_files $uri $uri/ @fallback;
}

# Additional security for API endpoints
location ~ ^/api/ {
    # Block JSON payloads attempting privilege escalation
    if ($request_body ~ '"admin":\s*true|"isAdmin":\s*true|"privileges":\s*\["admin"\]') {
        return 403;
    }

    # Block scope manipulation attempts
    if ($request_body ~ '"scope":\s*\[.*"admin".*\]|"scopes":\s*\[.*"admin".*\]') {
        return 403;
    }

    proxy_pass http://backend;
}

:material-file-download: prevention/nginx.conf

# ModSecurity Rules for CVE-2026-33579 - OpenClaw Privilege Escalation
# Protects against privilege escalation in /pair approve command path

# Rule 1000000: Block unauthorized /pair approve requests
SecRule REQUEST_URI "@contains /pair" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-33579: Potential OpenClaw privilege escalation attempt via /pair endpoint',\
    logdata:'URI: %{REQUEST_URI}, Method: %{REQUEST_METHOD}',\
    severity:CRITICAL,\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-33579',\
    chain"
SecRule ARGS "@contains approve" \
    "t:lowercase"

# Rule 1000001: Block requests to device-pair extension path
SecRule REQUEST_URI "@rx /extensions/device-pair/" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-33579: Access attempt to vulnerable device-pair extension path',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    severity:CRITICAL,\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-33579'"

# Rule 1000002: Monitor for scope manipulation in POST data
SecRule REQUEST_METHOD "@streq POST" \
    "id:1000002,\
    phase:2,\
    pass,\
    msg:'CVE-2026-33579: Monitoring scope parameters in POST request',\
    logdata:'Request Body: %{REQUEST_BODY}',\
    severity:WARNING,\
    tag:'cve-2026-33579',\
    chain"
SecRule ARGS|REQUEST_BODY "@rx (?:admin|scope|privilege)" \
    "t:lowercase"

# Rule 1000003: Block device pairing requests with admin scope
SecRule REQUEST_URI "@contains /pair" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-33579: Device pairing request with admin scope detected',\
    logdata:'URI: %{REQUEST_URI}, Args: %{ARGS}',\
    severity:CRITICAL,\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-33579',\
    chain"
SecRule ARGS|REQUEST_BODY "@rx admin" \
    "t:lowercase"

# Rule 1000004: Monitor infra/device-pairing.ts access patterns
SecRule REQUEST_URI "@contains device-pairing" \
    "id:1000004,\
    phase:2,\
    pass,\
    msg:'CVE-2026-33579: Access to device pairing infrastructure detected',\
    logdata:'URI: %{REQUEST_URI}, User-Agent: %{REQUEST_HEADERS.User-Agent}',\
    severity:NOTICE,\
    tag:'cve-2026-33579'"

# Rule 1000005: Block approve commands without proper authorization headers
SecRule REQUEST_URI "@rx /pair.*approve" \
    "id:1000005,\
    phase:2,\
    block,\
    msg:'CVE-2026-33579: Pair approve command without proper scope validation',\
    logdata:'URI: %{REQUEST_URI}, Authorization: %{REQUEST_HEADERS.Authorization}',\
    severity:CRITICAL,\
    tag:'attack-privilege-escalation',\
    tag:'cve-2026-33579',\
    chain"
SecRule &REQUEST_HEADERS:Authorization "@eq 0"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-33579?¶

CVE-2026-33579 is a Critical (9.9) vulnerability: OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-33579?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-33579?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.