CVE-2026-33577

Katalog CVE

CVSS 8.1 · High EPSS 0,42%

Kerentanan Incorrect Authorization pada openclaw. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2x4x-cc5g-qmmg advisory vendor
• https://github.com/openclaw/openclaw/commit/4d7cc6bb4fac68b5a5fadd1c5a23168281221f34 patch
• https://www.vulncheck.com/advisories/openclaw-insufficient-scope-validation-in-node-pair-approve advisory pihak ketiga