CVE-2026-33576: OpenClaw pre-auth media fetch

CISO Take

OpenClaw's Zalo channel handler fetches and persists inbound media to disk before verifying whether the sender is authorized, meaning any unauthenticated actor on the internet can trigger arbitrary network fetches and fill the media store at will. The vulnerability requires zero privileges and no user interaction (CVSS 6.5, AV:N/AC:L/PR:N/UI:N), and EPSS places it in the top 73rd percentile for exploitation likelihood, though no public exploit or active exploitation has been confirmed. In AI agent deployments where OpenClaw mediates external messaging channels, an attacker can systematically flood the media store to degrade or halt agent operations without obtaining any credential. Upgrade to OpenClaw 2026.3.28 or apply commit 68ceaf7a5f64a23e78b95eff055e4b497218312a; as an interim control, restrict Zalo channel ingress to known sender allowlists at the network or application layer.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium risk in isolation, elevated in AI agent production deployments. The complete absence of authentication barriers (PR:N, UI:N) makes mass exploitation trivial and automatable via scripted Zalo messaging. Impact is bounded to integrity and availability (I:L, A:L) with no confidentiality breach, but disk exhaustion can cause cascading failures in agent task queues, log pipelines, and model checkpoint storage if the media store shares filesystem space with ML workloads. The package carries 396 historical CVEs, signaling systemic security debt that amplifies confidence risk. Four downstream dependents extend blast radius modestly. Risk escalates materially if the OpenClaw host has broad filesystem access or if agent state and model artifacts share the same volume as the media store.

How does the attack unfold?

Initial Access

Attacker sends media-bearing Zalo messages to the target's OpenClaw-connected channel requiring no credentials or prior relationship.

AML.T0049

Pre-Auth Execution

OpenClaw fetches and writes each inbound media file to the local media store before executing any sender authorization check, violating CWE-863 correct authorization ordering.

AML.T0034.002

Resource Exhaustion

Attacker automates high-frequency large-payload media sends, filling disk storage and forcing repeated outbound connections from the victim host to attacker-controlled infrastructure.

AML.T0034

Impact

AI agent becomes unavailable as disk exhaustion prevents task processing, state persistence, and logging; outbound fetches may expose internal network topology or enable SSRF probing.

AML.T0029

Initial Access

Attacker sends media-bearing Zalo messages to the target's OpenClaw-connected channel requiring no credentials or prior relationship.

AML.T0049

Pre-Auth Execution

OpenClaw fetches and writes each inbound media file to the local media store before executing any sender authorization check, violating CWE-863 correct authorization ordering.

AML.T0034.002

Resource Exhaustion

Attacker automates high-frequency large-payload media sends, filling disk storage and forcing repeated outbound connections from the victim host to attacker-controlled infrastructure.

AML.T0034

Impact

AI agent becomes unavailable as disk exhaustion prevents task processing, state persistence, and logging; outbound fetches may expose internal network topology or enable SSRF probing.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A Low

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to 2026.3.28 or apply commit 68ceaf7a5f64a23e78b95eff055e4b497218312a.
Workaround if patching is delayed: configure the Zalo channel gateway to allowlist authorized sender IDs before messages reach OpenClaw's media handler.
Rate-limit inbound Zalo media requests per sender at the reverse proxy or firewall layer to cap throughput from a single attacker.
Apply disk quotas on the media store directory to contain blast radius from resource exhaustion attacks.
Monitor for anomalous spikes in media store disk consumption and unexpected outbound HTTP connections from the OpenClaw host as primary detection signals.

How is it classified?

Auth Bypass DoS Agent API AML.T0029 - Denial of AI Service AML.T0034.002 - Agentic Resource Consumption AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.8.1 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.2 - Risk response and treatment

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33576?

OpenClaw's Zalo channel handler fetches and persists inbound media to disk before verifying whether the sender is authorized, meaning any unauthenticated actor on the internet can trigger arbitrary network fetches and fill the media store at will. The vulnerability requires zero privileges and no user interaction (CVSS 6.5, AV:N/AC:L/PR:N/UI:N), and EPSS places it in the top 73rd percentile for exploitation likelihood, though no public exploit or active exploitation has been confirmed. In AI agent deployments where OpenClaw mediates external messaging channels, an attacker can systematically flood the media store to degrade or halt agent operations without obtaining any credential. Upgrade to OpenClaw 2026.3.28 or apply commit 68ceaf7a5f64a23e78b95eff055e4b497218312a; as an interim control, restrict Zalo channel ingress to known sender allowlists at the network or application layer.

Is CVE-2026-33576 actively exploited?

No confirmed active exploitation of CVE-2026-33576 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33576?

1. Patch immediately: upgrade OpenClaw to 2026.3.28 or apply commit 68ceaf7a5f64a23e78b95eff055e4b497218312a. 2. Workaround if patching is delayed: configure the Zalo channel gateway to allowlist authorized sender IDs before messages reach OpenClaw's media handler. 3. Rate-limit inbound Zalo media requests per sender at the reverse proxy or firewall layer to cap throughput from a single attacker. 4. Apply disk quotas on the media store directory to contain blast radius from resource exhaustion attacks. 5. Monitor for anomalous spikes in media store disk consumption and unexpected outbound HTTP connections from the OpenClaw host as primary detection signals.

What systems are affected by CVE-2026-33576?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-channel messaging integrations, API integrations.

What is the CVSS score for CVE-2026-33576?

CVE-2026-33576 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-channel messaging integrationsAPI integrations

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.002 Agentic Resource Consumption

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.8.1

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

Exploitation Scenario

An adversary targeting an organization's AI agent deployment identifies that the target runs OpenClaw with a Zalo channel for customer or internal messaging. The attacker registers a Zalo account and begins sending messages containing large media attachments to the exposed channel endpoint. With no authentication check in place at the media-fetch stage, OpenClaw's handler retrieves each payload and writes it to the local media store. The attacker scripts high-frequency sends with multi-megabyte files, exhausting available disk space within hours. As the disk fills, the AI agent fails to write task logs, persist agent state, or accept new jobs, effectively taking the agent offline. Concurrently, each fetch constitutes an outbound connection from the victim host to attacker-controlled infrastructure, providing the attacker with confirmed server IP addresses and an opportunity to probe internal services via SSRF if the media URL is crafted to target internal network ranges.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.