OpenClaw: Zalo channel downloads media before sender authorization
## Summary The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran. ## Impact Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected. ## Affected Component `extensions/zalo/src/monitor.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `68ceaf7a5f` (`zalo: gate image downloads before DM auth`). OpenClaw thanks @AntAISecurityLab for reporting.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33576US | —OT erhöht | — | ||
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writ… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312aWEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358jWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-33576ADVISORY
- https://www.vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channelWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan