Is there a patch available for CVE-2026-41374?

Yes, a patch is available for CVE-2026-41374. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41374

Q: What is the CVSS score of CVE-2026-41374?

CVE-2026-41374 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26083 MEDIUM

Incorrect Behavior Order: Early Amplification (CWE-408)

2026-04-28 VulnCheck

Denial Of Service Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:06 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26083

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

AnalysisAI

OpenClaw before version 2026.3.31 performs Discord audio preflight transcription without validating member authorization, allowing unauthenticated remote attackers to trigger resource-intensive audio processing and cause denial of service through resource exhaustion.

Technical ContextAI

OpenClaw is a Discord bot application that processes audio streams, likely for transcription or analysis purposes. The vulnerability exists in the audio preflight processing logic, which is the initial stage that prepares audio for transcription. This preprocessing step normally should only execute for authorized Discord server members, but the authorization check (member allowlist validation) is performed after the resource-intensive preflight transcription begins rather than before it. CWE-408 (Improper Resource Validation) indicates the root cause: the application fails to validate whether a user has permission to consume resources before allocating them to that user's request. The attack vector is the Discord audio preflight endpoint, which accepts network requests without authentication credentials.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later immediately. The vendor has released a patch available at https://github.com/openclaw/openclaw/commit/ee52f64226a03efadfdf1e3b759e13424a3d4e41. For deployments unable to upgrade immediately, implement network-level rate limiting on the audio preflight endpoint (limit requests per source IP to 1-5 per minute), restrict Discord bot permissions to prevent audio processing on unauthenticated requests, and monitor resource utilization (CPU, memory) with alerts set at 70-80% to detect ongoing attacks. Additionally, review Discord bot token permissions in your deployment to ensure the bot only processes audio from verified authorized guild members; disable audio processing features entirely if not required for your use case. These compensating controls reduce attack surface but may impact legitimate transcription service quality if rate limits are too aggressive.