CVE-2026-33576
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
OpenClaw before version 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.
Risk Assessment
An attacker can cause unauthorized file downloads and disk writes on the server, potentially leading to disk space exhaustion or storage of malicious content.
Recommendation
Update OpenClaw to version 2026.3.28 or later, which includes authorization validation before media download.
Original NVD description (English source)
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.