PT-2026-29256 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-33576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description OpenClaw does not validate sender authorization before downloading and storing inbound media from Zalo channels. This allows unauthorized senders to initiate network fetches and write data to the media store by sending messages that are later rejected. The issue involves a lack of proper validation when handling media received from Zalo channels.

Recommendations Update OpenClaw to version 2026.3.28 or later.

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2026-33576

GHSA-V2V2-F783-358J

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312a · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33576 · Security Note
• https://osv.dev/vulnerability/GHSA-v2v2-f783-358j · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channel · Note
• https://twitter.com/CVEnew/status/2039004445527216527 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039002820029157705 · Twitter Post
• https://twitter.com/CveFindCom/status/2039005665478214140 · Twitter Post