OpenClaw CVE-2026-41367

Exploitation requires: (1) the attacker is an authenticated member of a Discord server where OpenClaw is deployed and running a vulnerable version (2026.2.14 through 2026.3.24); (2) a Discord button or component interaction exists in that server that triggers a privileged action (e.g., message button, select menu); (3) guild or channel policy gates exist that should restrict the attacker's access to that action based on role or channel context; (4) the policy gate is enforced correctly for non-component commands in the same server (confirming the gates themselves function, but are bypassed only for components). Exploitation is NOT possible if: OpenClaw is not deployed, if the server has no policy gates configured, if component interactions are not used in the vulnerable bot, or if the server is running OpenClaw 2026.3.25 or later. The vulnerability is limited to component interactions and does not affect traditional text or slash command authorization.

CVSS 5.3 with AV:N/AC:L/PR:L indicates network-accessible exploitation requiring low privilege (PR:L suggests any authenticated Discord user in the server) with low attack complexity. Integrity Impact (VI:L) and Scope Impact (SI:L) reflect the ability to modify data or actions in limited scopes. The EPSS score is not provided, preventing comparative risk modeling. The authentication requirement (PR:L) is a significant limiting factor - this is not unauthenticated remote exploitation but requires the attacker to be a member of the Discord server, reducing real-world exploitability compared to public-facing services. However, the 'Authentication Bypass' tag and CWE-863 classification suggest this allows lower-privileged users to perform actions restricted to higher-privileged roles, which is a meaningful insider threat. KEV status unknown. No public POC or active exploitation evidence provided. The policy enforcement gap appears targeted at a specific interaction type (components), not systemic, which may limit the blast radius. Real-world priority depends on whether OpenClaw is widely deployed and whether the affected versions are common in production - the version range (2026.2.14 to 2026.3.24) spans only six weeks, suggesting either a very recent product or version schema anomaly.

An authenticated member of a Discord server with OpenClaw deployed encounters a button component in a message (e.g., 'Approve Request' or 'Delete Channel'). The member's role or channel permissions normally block this action. The attacker interacts with the button, triggering a component interaction that OpenClaw processes without re-validating the policy gates that would be checked for traditional commands. The privileged action executes successfully, allowing the attacker to perform actions (data modification, channel management) beyond their intended permissions.