A critical vulnerability in OpenClaw has left over 135,000 instances vulnerable to complete admin takeover. The flaw, tracked as CVE-2026-33579 with a CVSS score of 8.6, allows anyone with basic pairing access to approve themselves for admin privileges without proper authorization checks. The vulnerability affects versions before 2026.3.28.

What makes this particularly dangerous is the scale of exposure: 63% of publicly accessible OpenClaw instances run without authentication, meaning attackers can exploit this remotely with no credentials required. The attack chain is remarkably simple - connect to an unauthenticated instance, request pairing access, then use the /pair approve command to grant yourself admin rights. The system never verifies whether the approver has permission to grant such elevated privileges.

The patch was released on March 29, but the vulnerability was publicly disclosed on NVD just two days later, creating a narrow window for attackers to exploit unpatched systems. Security teams should immediately check their OpenClaw version and upgrade to 2026.3.28 if running anything earlier. Administrators should also review audit logs for suspicious /pair approve events and examine admin device registrations from the past week.