CVE-2026-33577：OpenClaw权限提升漏洞，版本低于2026.3.28

OpenClaw 中的 CVE-2026-33577 允许权限较低的操作员批准更广泛范围的挂起节点请求，可能导致配对节点上的权限提升。具体来说，节点配对批准路径没有始终执行批准调用者是否已经拥有节点请求的所有范围的检查。这意味着权限较少的用户可以批准授予其访问通常不具备的资源或功能的请求。

Organizations deploying OpenClaw in production environments, particularly those with complex node pairing configurations or a large number of users with varying access privileges, are at significant risk. Shared hosting environments where multiple users share the same OpenClaw instance are also particularly vulnerable, as a compromised user could potentially escalate their privileges across the entire platform.

• nodejs / server:

  journalctl -u openclaw | grep -i "node pairing approval"

• nodejs / server:

  ps aux | grep openclaw | grep -i "node pairing"

• generic web: Review OpenClaw access logs for unusual approval patterns or requests for excessively broad scopes. Look for approvals originating from unexpected user accounts or IP addresses.

1. 2026-04-01Disclosure

   disclosure

1. 已保留2026-03-23
2. 发布日期2026-04-01
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-08

为了减轻此漏洞，请升级到 OpenClaw 版本 2026.3.28 或更高版本。此版本包含一个修复程序，可确保节点配对批准过程在允许连接之前正确验证批准者是否拥有必要的范围。为了保护您的系统免受潜在攻击，务必尽快应用此更新。此外，请审查用户访问策略和权限，以确保遵循最小权限原则。