Policy Enforcement Bypass in OpenClaw for Discord Interactions by OpenClaw
CVE-2026-41367

5.3MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
27 April 2026

What is CVE-2026-41367?

OpenClaw versions ranging from 2026.2.14 to 2026.3.24 exhibit a significant vulnerability where guild and channel policy gates are not consistently enforced. This flaw allows malicious actors to initiate privileged actions on Discord components from contexts where they should be restricted, effectively bypassing intended safeguards. The oversight in policy enforcement poses risks that could be exploited through unauthorized button and component engagements, making it crucial for users to evaluate their instance of OpenClaw and remain informed about this security issue.

Affected Version(s)

OpenClaw 2026.2.14

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/openclaw-policy-enfo...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nathan (@nexrin)
KeenSecurityLab
qclawer
.