CVE-2026-33576: OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel
Summary
The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran.
Impact
Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected.
Affected Component
extensions/zalo/src/monitor.ts
Fixed Versions
- Affected: <= 2026.3.24 - Patched: >= 2026.3.28 - Latest stable 2026.3.28 contains the fix.
Fix
Fixed by commit 68ceaf7a5f (zalo: gate image downloads before DM auth).
Other sources
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.3.28 - Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.28 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 68ceaf7a5f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33576?
CVE-2026-33576 has a medium severity due to unauthorized media downloads by untrusted senders.
How do I fix CVE-2026-33576?
Fix CVE-2026-33576 by upgrading OpenClaw to version 2026.3.28 or later.
What does CVE-2026-33576 affect?
CVE-2026-33576 affects OpenClaw versions prior to 2026.3.28.
What is the main issue with CVE-2026-33576?
The main issue with CVE-2026-33576 is unauthorized media being downloaded due to insufficient sender validation.
Can CVE-2026-33576 lead to data loss?
Yes, CVE-2026-33576 can potentially lead to data loss due to unauthorized write operations to the media store.