Is there a patch available for CVE-2026-41382?

Yes, a patch is available for CVE-2026-41382. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41382

Q: What is the CVSS score of CVE-2026-41382?

CVE-2026-41382 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26091 LOW

Missing Authorization (CWE-862)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:07 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM LOW

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.4 (MEDIUM) 2.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26091

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

LOW 2.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation to gain unauthorized access to restricted voice channels.

AnalysisAI

OpenClaw before version 2026.3.31 allows authenticated attackers to bypass authorization controls on Discord voice channels through exploitation of stale-role validation gaps and improper channel name validation, enabling unauthorized access to restricted voice channels that should be protected by member and channel allowlists. The vulnerability requires valid Discord credentials but enables privilege escalation within voice channel access controls. No public exploit code has been identified at the time of analysis.

Technical ContextAI

OpenClaw integrates with Discord's voice infrastructure to enforce access controls via channel and member allowlists. The vulnerability stems from CWE-862 (Missing Authorization) in the Discord voice ingress validation logic. The authorization bypass occurs at two critical points: role validation does not properly synchronize with stale Discord role assignments, and channel name validation fails to correctly match restricted channel identifiers. This allows authenticated users to circumvent the intended allowlist enforcement mechanisms that should restrict voice channel membership to explicitly authorized Discord members and channels.

RemediationAI

Update OpenClaw to version 2026.3.31 or later, which addresses both the stale-role validation gap and channel name validation flaws. The upstream fix is available via GitHub commit dba96e7507e0900f120e5e28e57755d69bf78759 (https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759). Until patching is feasible, temporarily disable Discord voice ingress functionality if not operationally critical, or implement network-level access controls to restrict OpenClaw instances to trusted Discord servers and role groups as an interim compensating control. Note that disabling voice ingress may impact legitimate use cases, so coordinate with stakeholders before deployment.