CVE-2026-33576: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-33576 is an authorization bypass vulnerability in OpenClaw's Zalo channel integration, where inbound media is downloaded and stored before sender authorization checks are performed. Affecting all OpenClaw npm package versions up to and including 2026.3.24, the flaw allows any unauthenticated network sender to force media fetches and disk writes even when their messages are ultimately rejected. The vulnerability was reported by @AntAISecurityLab, published on March 29, 2026, and patched in version 2026.3.28. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization): the affected code in extensions/zalo/src/monitor.ts fetched and stored remote media referenced in Zalo image messages before invoking DM/pairing authorization checks. Specifically, the handleImageMessage function would call fetchRemoteMediaMock and saveMediaBufferMock prior to any sender validation, meaning the authorization gate was placed after the resource-consuming operations rather than before them. The fix (commit 68ceaf7a5f) refactors the flow to call authorizeZaloMessage first — using a sentinel value __pending_media__ to signal a pending image — and only proceeds with the actual media download if authorization succeeds (Github Advisory, Patch Commit).

Successful exploitation allows any unauthenticated remote attacker to trigger unsolicited network fetches and disk writes to the OpenClaw media store by sending crafted Zalo image messages. This can result in resource exhaustion through consumption of network bandwidth and disk storage, as well as potential integrity issues with the inbound media store. There is no confidentiality impact (no data is exposed to the attacker), but availability and integrity of the affected system are both degraded. At scale, automated abuse of this flaw could fill disk partitions or saturate network links, disrupting service for legitimate users (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires no authentication, no user interaction, and no special privileges — only the ability to send messages to a Zalo channel monitored by an OpenClaw instance. The EPSS score is approximately 0.018% (5th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target: Locate an OpenClaw instance (npm package version ≤ 2026.3.24) that has a Zalo channel integration configured and is reachable over the network.
2. Craft malicious Zalo message: Compose a Zalo image message containing a photo_url pointing to an attacker-controlled or large remote media resource.
3. Send message as unauthorized sender: Transmit the crafted image message from an account that is not authorized (not paired or not in the allowlist) to the target Zalo channel monitored by OpenClaw.
4. Trigger media download: OpenClaw's handleImageMessage function in monitor.ts fetches and stores the media referenced by photo_url before running DM/pairing authorization checks, causing a network fetch and disk write on the server.
5. Repeat at scale: Automate sending of such messages to exhaust disk space or network bandwidth on the target server, even though each message is ultimately rejected after the media is already stored (Github Advisory, Patch Commit).

• Network: Unusual outbound HTTP/HTTPS requests from the OpenClaw server to external media URLs originating from Zalo channel message processing; high-volume or repeated fetches to the same or varied external media endpoints.
• File System: Unexpected growth in the OpenClaw inbound media store directory; presence of media files corresponding to messages from unknown or unauthorized Zalo senders; disk space exhaustion on the media store partition.
• Logs: OpenClaw application logs showing media download activity (fetchRemoteMedia, saveMediaBuffer) followed immediately by authorization rejection entries for the same message; repeated log entries for rejected Zalo senders that nonetheless triggered media storage operations.
• Process: Elevated network I/O or disk write activity from the OpenClaw Node.js process without a corresponding increase in legitimate inbound message volume (Github Advisory).

The primary remediation is to upgrade the OpenClaw npm package to version 2026.3.28 or later, which gates image downloads behind DM/pairing authorization checks via commit 68ceaf7a5f (Github Advisory, Patch Commit). If immediate patching is not feasible, implement network-level controls to restrict inbound Zalo channel traffic to known trusted sender IPs or ranges. Additionally, monitor disk usage and network I/O on OpenClaw servers for anomalous spikes that may indicate exploitation attempts (Feedly).

The vulnerability was credited to researcher @AntAISecurityLab, who reported it to the OpenClaw project maintainers. The advisory was published by maintainer steipete on March 29, 2026. No significant broader media coverage or notable community debate has been identified beyond standard CVE tracking and aggregator listings (Github Advisory).