PT-2026-29256 · Openclaw · Openclaw
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.28
Description
OpenClaw does not validate sender authorization before downloading and storing inbound media from Zalo channels. This allows unauthorized senders to initiate network fetches and write data to the media store by sending messages that are later rejected. The issue involves a lack of proper validation when handling media received from Zalo channels.
Recommendations
Update OpenClaw to version 2026.3.28 or later.
Exploit
Correção
Missing Authorization
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openclaw