{"id":"EUVD-2026-17433","revision":"4bfa3b40e19c4bf58ef2d2da5a4a08c4","records":[{"revision":"4bfa3b40e19c4bf58ef2d2da5a4a08c4","observedAt":"2026-10-30T04:58:53.376+00:00","statement":{"source":"euvd","id":"EUVD-2026-17433","aliases":["CVE-2026-33577"],"title":"OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validat…","description":"OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in node-pairing.ts to extend privileges onto paired nodes beyond their authorization level.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.6,"severity":null}],"references":["https://github.com/openclaw/openclaw/security/advisories/GHSA-2x4x-cc5g-qmmg","https://github.com/openclaw/openclaw/commit/4d7cc6bb4fac68b5a5fadd1c5a23168281221f34","https://www.vulncheck.com/advisories/openclaw-insufficient-scope-validation-in-node-pair-approve"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-17433","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 31, 2026, 2:10:31 PM","dateUpdated":"Sep 24, 2026, 2:17:22 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-0930","title":"OpenClaw: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-33576","CVE-2026-33577","CVE-2026-33578","CVE-2026-33579","CVE-2026-33580","CVE-2026-33581","CVE-2026-34503","CVE-2026-34504","CVE-2026-41303","CVE-2026-41332","CVE-2026-41342","CVE-2026-41344","CVE-2026-41361","CVE-2026-41367","CVE-2026-41368","CVE-2026-41371","CVE-2026-41380","CVE-2026-41395"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-17433","identifiers":["EUVD-2026-17433","CVE-2026-33577"]},"retained":false,"historicalAffected":[]}],"coverage":[]}