OpenClaw CVE-2026-100546

Requires a Discord agent-proxy voice session running OpenClaw 2026.7.2-2026.9.1 with the realtime voice control path enabled AND an agent that distinguishes owner vs non-owner senders. The attacker must be an admitted non-owner participant (PR:L) in that live voice session and must produce concurrent control-classified transcripts that win the timing race against a legitimate owner's context (AC:H, AT:P - non-deterministic). Limiting factors: exploitation is gated on precise concurrent transcript timing the attacker cannot reliably force, on the specific realtime control path being in use, and on the owner-sensitive tools/commands actually exposed to the agent. The documented workaround - disabling Discord realtime voice for owner/non-owner-distinguishing agents - fully mitigates it.

Real-world risk is LOW-to-MODERATE despite the 6.1 CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N) is internally consistent with a hard-to-win race: AC:H and AT:P (Present attack requirement) reflect that exploitation depends on precise concurrent transcript timing that the attacker cannot deterministically control, and PR:L means the attacker must already be an admitted non-owner participant in an active Discord agent-proxy voice session. There is no EPSS score, no CISA KEV listing, and no public exploit - exploitation status is 'no public exploit identified at time of analysis.' The vendor's VI:H (high integrity impact) appears generous: the advisory itself states impact is bounded by the tools and commands available to the affected agent, and success is non-deterministic, so a blanket high-integrity rating overstates typical outcomes. No conflicting signals on attack vector (network-facing Discord path is genuine), but the race-dependent, config-gated nature makes this targeted/opportunistic at best rather than reliably exploitable. This is a legitimate authorization-confusion bug worth patching, not an urgent widespread threat.

A non-owner participant joins a Discord agent-proxy voice session that uses the affected realtime control path and speaks utterances timed to coincide with an owner's control-classified transcript. If the race is won, the attacker's utterance crosses the downstream agent boundary tagged with the owner's status, causing owner-only agent behavior to execute on the non-owner's command. No public proof-of-concept exists, and success is non-deterministic, depending on concurrent transcript timing.