Openclaw EUVD-2026-17005

The CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:N) indicates network-accessible exploitation requiring low attack complexity and authenticated user privileges, with confidentiality and integrity impacts rated as low. The authorization bypass classification and injection capability elevate the practical risk: while the CVSS score of 5.3 is moderate, the ability to inject crafted reaction text into trusted system session context could enable downstream attacks depending on how the application processes and acts on reaction data (e.g., command injection, logic manipulation, or data exfiltration if reactions trigger backend actions). The primary mitigating factor is the requirement for legitimate (though not allowlisted) Discord guild membership-this is not an unauthenticated flaw and reduces the attacker pool to individuals with access to the Discord server. No public exploit code or confirmed active exploitation (KEV status) was identified at analysis time, suggesting this is a validation gap rather than an actively weaponized vulnerability. Organizations relying on the allowlist for access control should prioritize patching to eliminate the authorization bypass before non-allowlisted users gain awareness of the flaw's exploitability.

An authenticated but non-allowlisted member of a Discord server running OpenClaw can craft a reaction to any message that triggers OpenClaw's reaction handler. Because the allowlist check is bypassed, the application accepts the reaction as a trusted system event and injects the reaction text into the downstream session context. If OpenClaw uses reactions to trigger commands or modify application state (e.g., voting systems, automation triggers), the attacker could manipulate application behavior by crafting reactions designed to match command keywords or trigger unintended logic paths. No public exploit code has been identified, but the vulnerability requires only Discord API interaction knowledge and membership in the target server to attempt.