OpenClaw CVE-2026-41341

Exploitation requires the attacker to be an authenticated Discord user (PR:L) who is already a participant in a Group DM channel where a vulnerable OpenClaw bot (version <= 2026.3.28) is present and actively handling component interactions. The misclassification only triggers on ChannelType.GroupDM interactions - deployments that never add the bot to Group DM channels are entirely unaffected. The discordConfig.dm.groupEnabled flag defaults to false; in the pre-patch code, Group DMs routed as DMs would still be subject to DM-level checks, limiting the bypass to the specific Group DM allowlist enforcement layer. Exploitation is not automatable per SSVC, and no network-level conditions (firewall rules, port exposure) are relevant since interaction is mediated through Discord's API.

All available signals converge on low real-world risk. The CVSS 4.0 score of 2.3 reflects limited impact (VC:L/VI:L, no availability impact), authenticated low-privilege access (PR:L), and specific attack requirements (AT:P - Group DM context with a deployed bot required). EPSS at 0.01% (2nd percentile) confirms negligible exploitation interest from the threat research community. SSVC categorizes exploitation as 'none,' automatable as 'no,' and technical impact as 'partial.' The vulnerability is absent from the CISA KEV catalog and no POC is publicly known. The vendor's own triage characterizes it as 'narrow' and 'low' severity - impact is bounded to Group DM policy enforcement bypass or incorrect session labeling within a specific bot deployment. Deployments that do not use OpenClaw in Group DM contexts are wholly unaffected. No signal conflicts exist in this dataset, though the CVSS 4.0 AC:L combined with AT:P is slightly inconsistent in framing - the attack requirements effectively impose complexity more analogous to CVSS 3.1 AC:H.

An authenticated Discord user who is a participant in a Group DM channel containing an OpenClaw bot (running version <= 2026.3.28) triggers a component interaction such as clicking a button or selecting a dropdown option. The bot's routing code misidentifies the interaction as coming from a private Direct Message, skipping the Group DM enable-check and channel allowlist, and processes the interaction as if the user were authorized. No public exploit code exists; the attacker must already be a member of the relevant Group DM.