OpenClaw
CVE-2026-41303
HIGH
GHSA-98hh-7ghg-x6rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Discord server access
-
DeliveryIdentify pending exec approval
-
ExploitSend crafted approval command
-
ExecutionBypass approvers allowlist
-
ImpactTrigger unauthorized host execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have authenticated access to the Discord server where the OpenClaw bot is deployed, specifically requiring membership with permissions to send text commands to channels where the bot is active. The OpenClaw instance must be configured with the Discord integration feature enabled and utilizing the channels.discord.execApprovals workflow for host execution gating. A pending execution request must exist in the approval queue for the attacker to target. Attack limitations: requires PR:L (low-privileged authenticated Discord account), not exploitable by completely external attackers without any Discord server access. The vulnerability does not affect OpenClaw deployments that do not use Discord integration or have disabled text-based approval commands. |
| Impact | Real-world risk is moderate despite the 8.7 CVSS score. CVSS vector (AV:N/AC:L/PR:L) indicates network-based exploitation requiring low-privileged credentials but no special complexity. However, EPSS exploitation probability is very low at 0.06% (18th percentile), suggesting minimal attacker interest or deployment footprint. CISA SSVC framework rates this as non-exploited, non-automatable, but with total technical impact - appropriate given that successful exploitation grants full control over execution approvals. The attack requires existing Discord access to the OpenClaw instance, significantly limiting the threat surface compared to truly unauthenticated remote exploits. Patch availability since version 2026.3.28 further reduces urgency. This is a genuine privilege escalation risk for organizations using OpenClaw's Discord approval features, but not a widespread internet-scale threat. The low EPSS score aligns with the niche nature of the affected product rather than low severity. |
| Exploit ScenarioDerived | An attacker with any authenticated Discord account in the OpenClaw server identifies a pending host execution request requiring privileged approval. Despite not being listed in the channels.discord.execApprovals.approvers allowlist, the attacker sends a crafted Discord text command that invokes the approval function. The authorization bypass allows the command to succeed, resolving the exec approval and triggering the associated host execution with full system access. This enables unauthorized command execution on managed infrastructure without detection through normal approval workflows. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 21, 2026
Authorization bypass in OpenClaw before 2026.3.28 allows authenticated Discord users to approve pending host execution requests without proper privileges. Attackers with low-privileged Discord accounts can bypass the execApprovals.approvers allowlist by sending crafted Discord text commands, gaining unauthorized approval authority for exec requests. EPSS score is relatively low (0.06%, 18th percentile), and no active exploitation is confirmed, but the vulnerability enables complete compromise of the execution approval workflow with low attack complexity.
Earlier versions of this analysis (1)
Authorization bypass in OpenClaw before 2026.3.28 enables authenticated Discord users to approve pending host execution requests despite not being on the designated approvers allowlist. Attackers with low-privilege Discord access can send specially crafted text commands to circumvent the channels.discord.execApprovals.approvers control and authorize execution of arbitrary commands on managed hosts. EPSS data not available for this recent CVE; no CISA KEV listing indicates targeted rather than widespread exploitation at time of analysis.
RemediationAI
Upgrade to OpenClaw version 2026.3.28 or later, which contains the authorization fix per the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-98hh-7ghg-x6rq. If immediate patching is not feasible, disable Discord text-based approval commands entirely and implement alternative approval mechanisms (web UI, API with proper authentication) until upgrade completion. Compensating control: audit Discord bot permissions to restrict command execution to specific channels with monitored access logs, though this does not eliminate the bypass vulnerability. Review existing approved execution requests in the audit trail for unauthorized approvals submitted between initial deployment and patch application. Temporary workaround: remove Discord bot integration and revert to manual out-of-band approval processes, accepting the operational overhead trade-off for security assurance until patching.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects OpenClaw's Discord-integrated execution approval system, which uses text-based commands to gate host execution requests. The flaw stems from CWE-863 (Incorrect Authorization), where the application fails to properly validate user permissions against the channels.discord.execApprovals.approvers allowlist before processing approval commands. The Discord integration layer inadequately enforces access control checks on text command handlers, allowing any authenticated Discord user to invoke approval functions regardless of their membership in the designated approver group. This represents a classic broken access control issue in a chat-ops workflow system.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.
Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
Executive ViewAI
OpenClaw versions prior to 2026.3.28 contain an authorization bypass that allows low-privilege Discord users to approve host command execution requests they are not authorized to approve, enabling unauthorized code execution on managed infrastructure. Organizations using OpenClaw for host management automation face immediate risk of privilege escalation and command injection through Discord bot interfaces, potentially affecting all systems managed through the platform.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Discord bot token permissions to read-only for approval channels; (2) Require secondary approval mechanism outside Discord for execution requests; (3) Disable automated host execution approval and require manual administrative approval with separate authentication factor; (4) Monitor and alert on all approval request messages containing execution commands; (5) Limit Discord bot channel access to designated approval channels only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Related Vulnerabilities in OpenClaw Multiple Authorization and Security Flaws
View all 14Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB