CVE-2026-33578
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
OpenClaw before 2026.3.28 has a vulnerability in the Google Chat and Zalouser extensions where group allowlist policies silently downgrade to open policy. Attackers can bypass sender restrictions and interact with bots.
Risk Assessment
Unauthorized senders can send messages to bots, potentially leading to information leakage or unauthorized actions.
Recommendation
Update OpenClaw to version 2026.3.28 or later.
Original NVD description (English source)
OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.