{"id":"EUVD-2026-17435","enisaUuid":"c43d92e9-3839-3839-80a6-7bc51fe21923","description":"OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.","datePublished":"Mar 31, 2026, 2:10:31 PM","dateUpdated":"Sep 24, 2026, 2:17:23 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-63mg-xp9j-jfcm\nhttps://github.com/openclaw/openclaw/commit/e64a881ae0fb8af18e451163f4c2d611d60cc8e4\nhttps://www.vulncheck.com/advisories/openclaw-sender-policy-allowlist-bypass-via-policy-downgrade-in-google-chat-and-zalouser-extensions\n","aliases":"CVE-2026-33578\n","assigner":"VulnCheck","epss":0.3,"enisaIdProduct":[{"id":"a5a30631-5665-3d92-a34a-5467820f0224","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.28"}],"enisaIdVendor":[{"id":"fad20da5-255e-3f03-a556-6d71da8ee5b9","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"096ee3b9-52ba-30ee-8efa-404a189fb9b1","vulnerability":{"id":"GHSA-63mg-xp9j-jfcm","description":"OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade","datePublished":"Apr 1, 2026, 12:01:10 AM","dateUpdated":"Apr 6, 2026, 4:46:04 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-63mg-xp9j-jfcm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33578\nhttps://github.com/openclaw/openclaw/commit/e64a881ae0fb8af18e451163f4c2d611d60cc8e4\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-sender-policy-allowlist-bypass-via-policy-downgrade-in-google-chat-and-zalouser-extensions\n","enisa_id":"EUVD-2026-17435\n","aliases":"GHSA-63mg-xp9j-jfcm\nCVE-2026-33578\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:47:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"26255b8a-5897-3c49-9021-d1a96ff5861c","vulnerability":{"id":"CVE-2026-33578","description":"OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.","datePublished":"Mar 31, 2026, 2:10:31 PM","dateUpdated":"Sep 24, 2026, 2:17:23 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-63mg-xp9j-jfcm\nhttps://github.com/openclaw/openclaw/commit/e64a881ae0fb8af18e451163f4c2d611d60cc8e4\nhttps://www.vulncheck.com/advisories/openclaw-sender-policy-allowlist-bypass-via-policy-downgrade-in-google-chat-and-zalouser-extensions\n","enisa_id":"EUVD-2026-17435\n","assigner":"VulnCheck","epss":0.3,"dataProcessed":"Nov 11, 2026, 7:23:33 AM","vulnerabilityProduct":[{"id":"c8af5c62-2bb9-35e4-8700-493004807c78","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.28"}],"vulnerabilityVendor":[{"id":"d8b808ed-c2c0-328e-a7f7-4e1ff774b9b8","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[{"id":"b4e931ba-f136-3ec4-927d-92d0782c92d0","advisory":{"id":"WID-SEC-W-2026-0930","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Mar 30, 2026, 10:00:00 PM","dateUpdated":"Apr 28, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0930.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0930\n","aliases":"CVE-2026-33576\nCVE-2026-33577\nCVE-2026-33578\nCVE-2026-33579\nCVE-2026-33580\nCVE-2026-33581\nCVE-2026-34503\nCVE-2026-34504\nCVE-2026-41303\nCVE-2026-41332\nCVE-2026-41342\nCVE-2026-41344\nCVE-2026-41361\nCVE-2026-41367\nCVE-2026-41368\nCVE-2026-41371\nCVE-2026-41380\nCVE-2026-41395\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"916871f7-7abb-33b2-a5b7-8fab819bbc05","product":{"name":"2026.3.28","vendor":{"name":"open source"}}},{"id":"dd101b2f-0984-30e9-8e6c-624c033416de","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}}]}}]}