CVE-2026-41367

MEDIUM CVSS 5.0 View on NVD ↗

Description

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected Products

openclaw/openclaw

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-jp4j-q5fc-58gv
https://www.vulncheck.com/advisories/openclaw-policy-enforcement-bypass-in-discord-component-interactions

Published: Apr 28, 2026 00:16 UTC Modified: Apr 28, 2026 18:45 UTC