OpenClaw Unauthorized Media Download Vulnerability via Zalo Channel

A vulnerability in OpenClaw versions prior to 2026.3.28 allows unauthorized senders to manipulate media downloads from Zalo channels. The application fetches and stores inbound media before verifying sender authorization, enabling unauthorized messages to trigger network requests and disk writes to the media store, even if the messages are later rejected.

Impact

Exploitation of this vulnerability could lead to unauthorized media downloads, causing potential privacy concerns or misuse of stored media.

Remediation

Users can upgrade to OpenClaw version 2026.3.28 or later, where this vulnerability has been patched.