CVE-2026-33578: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-33578 is a sender policy bypass vulnerability in OpenClaw's Google Chat and Zalouser extensions, where route-level group allowlist policies silently downgrade to an open policy instead of preserving the configured restrictions. This allows any authenticated member of an allowlisted Google Chat space or Zalouser group to interact with bots despite operator-configured sender-level restrictions. The vulnerability affects OpenClaw versions up to and including 2026.3.24 (npm package), with the fix available in version 2026.3.28. It was reported by @AntAISecurityLab, published to the GitHub Advisory Database on April 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, OpenClaw Advisory).

The root cause is an incorrect authorization check (CWE-863) in the sender policy resolution logic within extensions/googlechat/src/monitor-access.ts and extensions/zalouser/src/monitor.ts. When a route-level group allowlist is configured but no explicit sender-level allowlist (groupAllowFrom) is populated, the resolveSenderScopedGroupPolicy function was called with an empty allowlist, causing it to return an open policy rather than preserving the intended allowlist group policy. The fix (commit e64a881ae0) introduces a conditional check: if an allowlist is configured and the sender allowlist is empty, the route-level group policy is preserved directly without delegating to resolveSenderScopedGroupPolicy, preventing the silent downgrade (OpenClaw Advisory, Fix Commit).

Successful exploitation allows any authenticated member of an allowlisted Google Chat space or Zalouser group to interact with bots that the operator intended to restrict to specific senders. This can expose sensitive bot functionality, commands, or information to unauthorized group members. There is no direct availability or integrity impact to the underlying system, and no evidence of lateral movement potential; the primary risk is unauthorized access to bot-mediated functionality and limited confidentiality exposure (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be an authenticated member of an allowlisted group, limiting the attack surface to insiders or users with existing group membership.

1. Identify a target: Locate an OpenClaw bot deployment (version <= 2026.3.24) integrated with Google Chat or Zalouser that has a route-level group allowlist configured but no explicit sender-level (groupAllowFrom) allowlist defined.
2. Gain group membership: Become a member of the allowlisted Google Chat space or Zalouser group — this may be achievable through normal onboarding, invitation, or social engineering.
3. Interact with the bot: Send messages or commands to the bot from within the group. Due to the policy downgrade bug, the bot's sender policy silently resolves to open, bypassing the intended allowlist restriction.
4. Access restricted functionality: Issue bot commands or queries that were intended to be restricted to specific authorized senders, potentially retrieving sensitive information or triggering privileged bot actions (OpenClaw Advisory, Fix Commit).

• Logs: Bot interaction logs showing messages processed from group members who are not in the configured sender allowlist; absence of access denial log entries for unauthorized senders in Google Chat or Zalouser group contexts.
• Application Behavior: Bot responding to commands from group members outside the intended sender allowlist when groupAllowFrom is configured but empty; unexpected bot replies in group channels where sender restrictions were believed to be enforced.
• Configuration Audit: OpenClaw configurations where groups entries are defined with allow: true but no corresponding groupAllowFrom or allowFrom sender list is populated — these configurations were silently treated as open policy in affected versions (OpenClaw Advisory).

Upgrade OpenClaw to version 2026.3.28 or later, which contains the fix introduced in commit e64a881ae0 ("Channels: preserve routed group policy") (Github Advisory, Fix Commit). As a temporary workaround prior to patching, operators can explicitly populate the groupAllowFrom (Zalouser) or equivalent sender allowlist fields in their bot configuration to prevent the policy from resolving to open. After patching, audit bot access logs to identify any unauthorized interactions that may have occurred while running affected versions.

The vulnerability was reported by @AntAISecurityLab and acknowledged by the OpenClaw maintainers in the official security advisory (OpenClaw Advisory). Coverage appeared on The Hacker Wire and was noted in automated CVE tracking feeds shortly after disclosure. No significant broader industry commentary or notable researcher debate has been observed beyond routine CVE aggregation.