CVE-2026-33576CWE-863

OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel

Medium · published March 31, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel
    cvelistv5