CVE-2026-33578: OpenClaw allowlist bypass exposes

CISO Take

OpenClaw's Google Chat and Zalouser extensions silently discard route-level group allowlist policies, making any configured sender restriction effectively useless — any authenticated user on the platform can interact with bots that should be access-controlled. With attack complexity rated Low and only a low-privilege account required, the barrier to abuse is minimal; the EPSS places this in the top 79th percentile for exploitation likelihood despite no public exploit existing yet. Organizations running OpenClaw-powered bots in Google Workspace or Zalo environments are at risk of unauthorized users querying agents that surface sensitive role-restricted data, with cascading exposure to any backend systems the agent is wired to. Patch to version 2026.3.28 (commit e64a881a), enforce allowlists at the Google Chat App or Zalouser platform layer as an interim workaround, and audit bot interaction logs for unauthorized access predating the patch.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity overall, but elevated risk for organizations that rely on OpenClaw's sender policies as the primary access boundary for AI agents. The CVSS vector (AV:N/AC:L/PR:L/UI:N) means any authenticated network user can exploit this without special tooling or user interaction. No active exploitation or CISA KEV listing reduces emergency urgency. The 396 other CVEs tracked against this package and 4 downstream dependents suggest a niche but potentially high-trust deployment pattern where access control failures have disproportionate impact on sensitive data exposure.

How does the attack unfold?

Initial Access

Attacker authenticates to Google Chat or Zalouser as any low-privilege enterprise user and identifies an OpenClaw-powered bot configured with a group allowlist.

AML.T0049

Authorization Bypass

Attacker sends a direct message to the restricted bot; OpenClaw's route-level policy resolution silently downgrades the group allowlist to an open policy, granting access without error or alerting administrators.

AML.T0107

Agent Tool Invocation

Attacker interacts with the now-accessible agent, prompting it to invoke connected tools — data lookups, API calls, document retrieval — that surface sensitive role-restricted information.

AML.T0053

Data Exfiltration

Sensitive data returned through agent responses is read directly from the chat interface, bypassing all downstream access controls that assumed the sender allowlist was enforced.

AML.T0085.001

Initial Access

Attacker authenticates to Google Chat or Zalouser as any low-privilege enterprise user and identifies an OpenClaw-powered bot configured with a group allowlist.

AML.T0049

Authorization Bypass

Attacker sends a direct message to the restricted bot; OpenClaw's route-level policy resolution silently downgrades the group allowlist to an open policy, granting access without error or alerting administrators.

AML.T0107

Agent Tool Invocation

Attacker interacts with the now-accessible agent, prompting it to invoke connected tools — data lookups, API calls, document retrieval — that surface sensitive role-restricted information.

AML.T0053

Data Exfiltration

Sensitive data returned through agent responses is read directly from the chat interface, bypassing all downstream access controls that assumed the sender allowlist was enforced.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.3.28 or later (patch commit e64a881ae0fb8af18e451163f4c2d611d60cc8e4).
If immediate patching is not feasible, shift allowlist enforcement to the Google Chat App configuration or Zalouser platform controls rather than relying on OpenClaw route policies.
Audit OpenClaw bot interaction logs for anomalous access — identify any users outside the intended allowlist groups who interacted with restricted bots prior to patching.
Add secondary authorization checks at the agent tool invocation layer as defense-in-depth.
Inventory all deployed OpenClaw bots and their configured allowlists to scope the exposure window and prioritize audit of bots with access to sensitive data sources.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085.001 - AI Agent Tools AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1 - Access control

NIST AI RMF

GOVERN 1.1 - Policies, processes, and accountability for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33578?

OpenClaw's Google Chat and Zalouser extensions silently discard route-level group allowlist policies, making any configured sender restriction effectively useless — any authenticated user on the platform can interact with bots that should be access-controlled. With attack complexity rated Low and only a low-privilege account required, the barrier to abuse is minimal; the EPSS places this in the top 79th percentile for exploitation likelihood despite no public exploit existing yet. Organizations running OpenClaw-powered bots in Google Workspace or Zalo environments are at risk of unauthorized users querying agents that surface sensitive role-restricted data, with cascading exposure to any backend systems the agent is wired to. Patch to version 2026.3.28 (commit e64a881a), enforce allowlists at the Google Chat App or Zalouser platform layer as an interim workaround, and audit bot interaction logs for unauthorized access predating the patch.

Is CVE-2026-33578 actively exploited?

No confirmed active exploitation of CVE-2026-33578 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33578?

1. Upgrade OpenClaw to version 2026.3.28 or later (patch commit e64a881ae0fb8af18e451163f4c2d611d60cc8e4). 2. If immediate patching is not feasible, shift allowlist enforcement to the Google Chat App configuration or Zalouser platform controls rather than relying on OpenClaw route policies. 3. Audit OpenClaw bot interaction logs for anomalous access — identify any users outside the intended allowlist groups who interacted with restricted bots prior to patching. 4. Add secondary authorization checks at the agent tool invocation layer as defense-in-depth. 5. Inventory all deployed OpenClaw bots and their configured allowlists to scope the exposure window and prioritize audit of bots with access to sensitive data sources.

What systems are affected by CVE-2026-33578?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Chatbot and conversational AI deployments, Enterprise messaging integrations, Multi-tenant AI agent deployments.

What is the CVSS score for CVE-2026-33578?

CVE-2026-33578 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksChatbot and conversational AI deploymentsEnterprise messaging integrationsMulti-tenant AI agent deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085.001 AI Agent Tools

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.

Exploitation Scenario

An attacker authenticated to a corporate Google Chat workspace identifies an OpenClaw-powered HR assistant bot that is supposed to be restricted to HR staff via a group allowlist. Due to the policy downgrade bug, the attacker — a regular employee outside the HR group — sends a direct message to the bot and receives a full response as if authorized. The attacker iteratively queries the agent for sensitive employee records, compensation data, or organizational charts that the agent retrieves from connected HR systems, extracting information that bypasses every downstream access control that assumed the sender allowlist was enforced. No exploit code or special tooling is required.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.