CVE-2026-33576
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.
- Affected products
- Openclaw
- Openclaw
- < 2026.3.28
- Fix
- Available
- CVSS 4.0
- 6.9 MEDIUM
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.4% (28th percentile)
- Weakness
- CWE-863
- NVD status
- Analyzed
- Published
- 2026-03-31
CVE-2026-33576 at NVD
No indexed exploits for CVE-2026-33576 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-33576 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.