CVE-2026-33578: OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions
Summary
When only a route-level group allowlist was configured, sender policy resolution silently downgraded from allowlist to open instead of preserving the configured group policy.
Impact
Any member of an allowlisted Google Chat space or Zalouser group could interact with the bot even when the operator intended sender-level restrictions.
Affected Component
extensions/googlechat/src/monitor-access.ts, extensions/zalouser/src/monitor.ts
Fixed Versions
- Affected: <= 2026.3.24 - Patched: >= 2026.3.28 - Latest stable 2026.3.28 contains the fix.
Fix
Fixed by commit e64a881ae0 (Channels: preserve routed group policy).
Other sources
OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.3.28 - Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.28 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e64a881ae0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33578?
CVE-2026-33578 is considered a medium severity vulnerability due to its potential to bypass sender policy allowlists.
How do I fix CVE-2026-33578?
To fix CVE-2026-33578, update OpenClaw to version 2026.3.28 or later.
What versions of OpenClaw are affected by CVE-2026-33578?
OpenClaw versions prior to 2026.3.28 are affected by CVE-2026-33578.
What type of vulnerability is CVE-2026-33578?
CVE-2026-33578 is a sender policy allowlist bypass vulnerability.
In which extensions does CVE-2026-33578 occur?
CVE-2026-33578 occurs in the Google Chat and Zalouser extensions within OpenClaw.