---
id: CVE-2026-33576
title: >-
  OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo
  channels before validating sender authorization
summary: >-
  OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo
  channels before validating sender authorization. Unauthorized senders can
  force network fetches and disk writes to the media store by sending messages
  that are subseq…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-863
vendor: openclaw
product: openclaw
affected:
  - openclaw < 2026.3.28
patched:
  - openclaw 2026.3.28
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33576'
references:
  - url: >-
      https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312a
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358j
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channel
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00431
epssPercentile: 0.34679
ingestedAt: '2026-07-24T21:39:13.017Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-02T15:11:13.554545Z'
---

## Overview

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

## Affected

- `openclaw < 2026.3.28`

## Remediation

Upgrade past the affected range:

- `openclaw 2026.3.28`