9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33578

CVE-2026-33578: OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

Summary

When only a route-level group allowlist was configured, sender policy resolution silently downgraded from allowlist to open instead of preserving the configured group policy.

Impact

Any member of an allowlisted Google Chat space or Zalouser group could interact with the bot even when the operator intended sender-level restrictions.

Affected Component

extensions/googlechat/src/monitor-access.ts, extensions/zalouser/src/monitor.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit e64a881ae0 (Channels: preserve routed group policy).

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33578

CVE-2026-33578:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.24	2026.3.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis focused on the provided commit e64a881ae0, which directly addresses the reported security issue. The commit modified two files, extensions/googlechat/src/monitor-access.ts and extensions/zalouser/src/monitor.ts, which are responsible for handling access control for Google Chat and Zalouser integrations, respectively.

The core of the vulnerability was a logic flaw in how sender access policies were resolved. In both affected files, the code would determine the senderGroupPolicy. Prior to the patch, this was done by calling resolveSenderScopedGroupPolicy. The vulnerability description indicates that this function would 'silently downgrade' the policy from allowlist to open when a route-level allowlist was configured but the specific group/space had no sender allowlist defined. This effectively bypassed the intended security control, allowing unauthorized interactions.

The patch introduces a conditional check in both applyGoogleChatInboundAccessPolicy (for Google Chat) and processMessage (for Zalouser). This check verifies if a route-level allowlist is configured and if the specific group's sender list is empty. If both conditions are true, the code now preserves the original, more restrictive groupPolicy (e.g., allowlist) instead of calling resolveSenderScopedGroupPolicy and getting a downgraded open policy.

Therefore, the functions applyGoogleChatInboundAccessPolicy and processMessage are the key vulnerable functions, as they contained the flawed logic that led to the authorization bypass. During an exploit, these functions would be invoked to process an incoming message or event, and due to the vulnerability, would incorrectly grant access to an unauthorized user.

Vulnerable functions

applyGoogleChatInboundAccessPolicy

extensions/googlechat/src/monitor-access.ts

The function was vulnerable because it would call `resolveSenderScopedGroupPolicy` even when a group-level allowlist was configured but no specific users were defined for a particular space. This resulted in the policy being downgraded to 'open', bypassing the intended sender restrictions. The patch corrects this by preserving the original `groupPolicy` if a group allowlist is configured but the user list for the space is empty.

processMessage

extensions/zalouser/src/monitor.ts

This function contained a logic flaw where if a route-level allowlist was configured for Zalouser groups, but a specific group had an empty sender allowlist (`configGroupAllowFrom`), the `senderGroupPolicy` would be downgraded to 'open' by `resolveSenderScopedGroupPolicy`. This allowed any member of the group to interact with the bot. The fix ensures that if a route-level allowlist exists and the group-specific list is empty, the more restrictive `groupPolicy` is used instead.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.