PT-2026-29256 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-33576

Mitre

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33576

Affected Products

Openclaw

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33576 · Security Note
• https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312a · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358j · Note
• https://vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channel · Note