Home

Description

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

PUBLISHED Reserved 2026-04-20 | Published 2026-04-27 | Updated 2026-04-28 | Assigner VulnCheck




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

MEDIUM: 5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Problem types

CWE-863: Incorrect Authorization

Product status

Default status
unaffected

2026.2.14 (semver) before *
affected

Credits

Nathan (@nexrin) reporter

KeenSecurityLab finder

qclawer finder

References

github.com/...enclaw/security/advisories/GHSA-jp4j-q5fc-58gv (GitHub Security Advisory (GHSA-jp4j-q5fc-58gv)) vendor-advisory

www.vulncheck.com/...ypass-in-discord-component-interactions (VulnCheck Advisory: OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions) third-party-advisory

cve.org (CVE-2026-41367)

nvd.nist.gov (CVE-2026-41367)

Download JSON