CVE-2026-33576: Openclaw Auth Bypass Vulnerability

CVE-2026-33576 Overview

CVE-2026-33576 is an Incorrect Authorization vulnerability (CWE-863) in OpenClaw, a Node.js application that integrates with Zalo messaging channels. The vulnerability exists in versions before 2026.3.28 where the application downloads and stores inbound media from Zalo channels before validating sender authorization. This flaw allows unauthorized senders to force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

Critical Impact

Unauthorized users can force the OpenClaw server to download and store arbitrary media files, potentially exhausting disk space and network bandwidth without proper authentication.

Affected Products

• OpenClaw versions before 2026.3.28
• OpenClaw for Node.js (all affected versions)

Discovery Timeline

• 2026-03-31 - CVE-2026-33576 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33576

Vulnerability Analysis

This vulnerability represents an Incorrect Authorization flaw in the media handling pipeline of OpenClaw's Zalo channel integration. The application processes incoming messages from Zalo and downloads associated media files to local storage before performing authorization checks on the message sender.

The core issue stems from the order of operations in the message processing workflow. When a message containing media (such as images) arrives from the Zalo channel, OpenClaw immediately initiates a network fetch for the media content and writes it to the media store. Only after these I/O operations complete does the system check whether the sender is actually authorized to interact with the bot.

This design flaw enables unauthorized senders to abuse the system by sending media-rich messages that trigger resource-intensive operations. Even though these messages are eventually rejected during the authorization phase, the damage—network bandwidth consumption and disk writes—has already occurred.

Root Cause

The root cause is improper ordering of security controls in the message processing pipeline. Authorization checks should occur before any resource-consuming operations like media downloads. The vulnerable code path in extensions/zalo/src/monitor.ts processed image downloads before verifying sender permissions, violating the principle of fail-fast security validation.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without authentication:

1. The attacker identifies an OpenClaw instance connected to a Zalo channel
2. The attacker sends messages containing media attachments through the Zalo channel
3. OpenClaw downloads and stores each media file before checking authorization
4. The authorization check fails and the message is rejected, but resources have already been consumed
5. By repeatedly sending unauthorized messages with large media files, the attacker can exhaust disk space or consume significant network bandwidth

The security patch introduces a ZaloMessageAuthorizationResult type and gates image downloads behind DM authorization checks:

   text?: string;
   mediaPath?: string;
   mediaType?: string;
+  authorization?: ZaloMessageAuthorizationResult;
 };
 type ZaloImageMessageParams = ZaloProcessingContext & {
   message: ZaloMessage;
   mediaMaxMb: number;
 };
+type ZaloMessageAuthorizationResult = {
+  chatId: string;
+  commandAuthorized: boolean | undefined;
+  isGroup: boolean;
+  rawBody: string;
+  senderId: string;
+  senderName: string | undefined;
+};
 
 function formatZaloError(error: unknown): string {
   if (error instanceof Error) {

Source: GitHub Commit Update

Detection Methods for CVE-2026-33576

Indicators of Compromise

• Unusual spike in disk writes to the OpenClaw media store directory
• High volume of rejected/unauthorized messages from the Zalo channel in application logs
• Abnormal network traffic patterns fetching media from Zalo CDN endpoints
• Rapid growth in media storage consumption without corresponding valid message activity

Detection Strategies

• Monitor OpenClaw application logs for patterns of authorization failures following media downloads
• Implement rate limiting alerts for incoming Zalo channel messages from untrusted senders
• Track disk I/O metrics on the media store volume for anomalous write patterns
• Analyze network traffic logs for excessive outbound requests to Zalo media servers

Monitoring Recommendations

• Configure alerting on disk usage thresholds for the OpenClaw media storage directory
• Set up log aggregation rules to correlate media download events with subsequent authorization failures
• Implement bandwidth monitoring on OpenClaw server network interfaces
• Enable audit logging for all Zalo channel message processing events

How to Mitigate CVE-2026-33576

Immediate Actions Required

• Update OpenClaw to version 2026.3.28 or later immediately
• Review media storage directories for unexpected content that may have been downloaded through this vulnerability
• Implement network-level rate limiting on Zalo channel endpoints as a temporary measure
• Monitor disk space utilization on OpenClaw servers pending patch deployment

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.28. The fix implements proper authorization gating before media download operations. The security patch is available in commit 68ceaf7a5f64a23e78b95eff055e4b497218312a. For detailed information, refer to the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Implement external rate limiting at the network or application gateway level to restrict incoming message volume
• Configure disk quotas on the media storage directory to prevent storage exhaustion
• Consider temporarily disabling Zalo channel integrations if immediate patching is not possible
• Deploy network-level filtering to limit connections to known Zalo media endpoints

# Example: Configure disk quota on media storage (Linux)
# Set 10GB quota on the OpenClaw media directory
mkdir -p /var/openclaw/media
mount -o remount,usrquota /var/openclaw
setquota -u openclaw 10485760 11534336 0 0 /var/openclaw