CVE-2026-33576Disclosure(openclaw / openclaw)

LOWCVSS 6.9 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

openclaw CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312a

Vendor / third-party advisories

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

The Hacker Wire@TheHackerWire192d
Disclosure
🔴 CVE-2026-33576 - Critical OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to t... https://www.thehackerwire.com/vulnerability/CVE-2026-33576/ https://t.co/rR6OlZMDOn
Post summary
The tweet discloses a critical vulnerability in OpenClaw 2026.3.28 and earlier, where unauthorized Zalo channel senders can trigger network fetches and disk writes, but it provides no PoC, exploitation code, active usage claims, or patch information.
1000058
163 followersView on X
CVEFind.com@CveFindCom192d
Disclosure
[CVE-2026-33576: CRITICAL] Beware of OpenClaw vulnerability! Unauthorized senders can trigger network fetches and disk writes to media store due to lack of sender validation. #cybersecurity#cve,CVE-2026-33576,#cybersecurity https://cvefind.com/CVE-2026-33576
Post summary
The tweet alerts that CVE‑2026‑33576 in OpenClaw allows unauthorized senders to trigger network fetches and file writes via missing validation, but it offers no PoC, exploit code, or patch information.
0000041
617 followersView on X
CVE@CVEnew192d
Disclosure
CVE-2026-33576 OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches… https://www.cve.org/CVERecord?id=CVE-2026-33576
Post summary
The CVE-2026-33576 vulnerability in OpenClaw allows unauthenticated senders to trigger network fetches of inbound media, potentially leading to remote code execution, but no exploits, patches, or indications of active exploitation are reported.
0000091
56.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-33576

The Hacker Wire@TheHackerWireDisclosure

The tweet discloses a critical vulnerability in OpenClaw 2026.3.28 and earlier, where unauthorized Zalo channel senders can trigger network fetches and disk writes, but it provides no PoC, exploitation code, active usage claims, or patch information.

CVEFind.com@CveFindComDisclosure

The tweet alerts that CVE‑2026‑33576 in OpenClaw allows unauthorized senders to trigger network fetches and file writes via missing validation, but it offers no PoC, exploit code, or patch information.

CVE@CVEnewDisclosure

The CVE-2026-33576 vulnerability in OpenClaw allows unauthenticated senders to trigger network fetches of inbound media, potentially leading to remote code execution, but no exploits, patches, or indications of active exploitation are reported.