OpenClaw CVE-2026-33579: Assume Compromise, Patch Now, and Check Your Logs
Analysis
Step-by-Step: How to Check If Your OpenClaw Instance Was Compromised via CVE-2026-33579
Blink, who ran the scan that found 63% of exposed instances had no auth, published the most actionable post-exploitation checklist available. If you run OpenClaw and haven't checked your pair_approve logs, this is your first stop.
OpenClaw CVE-2026-33579: The Pairing Subsystem Has Now Produced Six Auth CVEs in Six Weeks
The gNerdSEC breakdown makes the pattern explicit: this isn't bad luck, it's architectural debt in the same extensions/device-pair boundary failing repeatedly. Three HIGH or CRITICAL fixes shipped in a single release is a design smell, not a patch cycle.
News
CVE-2026-33579 Patched in 2026.3.28, But a 48-Hour NVD Blind Spot Let Attackers Move First
The patch shipped March 29, the CVE hit NVD March 31, and automated scanners started hitting exposed instances within hours of the listing. If your team watches NVD instead of GitHub advisories directly, you were blind for two days during active exploitation.
FailSafe confirms 63,070 live instances remain actively exploitable as of late March, with attackers pivoting from pairing exploits to stealing API keys and enrolling hosts into botnets. One-click hosting deployments are the biggest exposure vector right now.
500K Instances, No Kill Switch, and a CEO's Live Agent Sold on BreachForums for $25K
The BreachForums listing selling a CEO's live OpenClaw session including production DB, API keys, and real-time conversations is the clearest illustration yet of what no-auth plus no centralized patching actually costs in practice. This is the threat model builders need to internalize before deploying agents with broad data access.
Stay Ahead
Delivered each morning.