CVE Watch24 jul 2026

CVE-2026-33578

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group a

CVSS

4.3

Medio

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Publicado: 31 mar 2026 · Última mod.: 24 jul 2026 · CWE-863

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-08-112026-09-07

Descripción técnica

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-870758.1 ALT

—

———Tanium addressed an improper access controls vulnerability in Comply.6h CVE-2026-870464.3 MED

—

———Tanium addressed an improper access controls vulnerability in Comply.6h CVE-2026-148924.3 MED

—

———Tanium addressed an improper access controls vulnerability in Tanium Server.6h CVE-2026-87652—

—

———Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)8h CVE-2026-87651—

—

———Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)8h CVE-2026-87644—

—

———Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)8h