Executive Summary

CVE-2026-41303 is a high-severity authorization bypass vulnerability in OpenClaw versions before 2026.3.28. It affects the Discord text approval commands by allowing unauthorized users to bypass the approver allowlist configured in channels.discord.execApprovals.approvers.

This flaw enables attackers with low privileges to send Discord text commands that resolve pending host execution approvals without proper authorization, effectively granting them approval capabilities they should not have.

The vulnerability is classified under CWE-863 (Incorrect Authorization) and was fixed in OpenClaw version 2026.3.28.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with minimal privileges to bypass authorization controls and approve pending execution requests on hosts.

• Unauthorized users can execute commands that should be restricted to authorized approvers.
• It can lead to unauthorized data access, modification, and potential disruption of service.

Because the attacker can approve execution requests without proper authorization, this poses a significant security risk, potentially allowing malicious actions on affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-41303 vulnerability, you should immediately upgrade OpenClaw to version 2026.3.28 or later, where the authorization bypass flaw in Discord text approval commands has been fixed.

This update enforces proper approver checks for the channels.discord.execApprovals.approvers allowlist, preventing unauthorized users from approving pending execution requests.

Until the update can be applied, restrict access to the Discord text approval commands and monitor for any unauthorized approval activities.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-41303 is an authorization bypass vulnerability that allows unauthorized users to approve pending execution requests in OpenClaw's Discord integration. This flaw can lead to unauthorized execution of commands, potentially resulting in unauthorized access, modification, or disruption of sensitive data or services.

Such unauthorized actions could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. The vulnerability's high severity and potential for unauthorized data access and modification indicate a risk of violating these regulatory requirements.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized users sending Discord text commands to bypass the approver allowlist and approve pending host execution requests in OpenClaw versions prior to 2026.3.28.

To detect exploitation attempts on your system or network, monitor Discord text commands related to execution approvals, especially the `/approve` command, for usage by users who are not in the configured approvers allowlist.

Suggested detection steps include:

• Review Discord logs or message histories for `/approve` commands issued by unauthorized users.
• Audit OpenClaw logs for execution approval events and correlate them with user identities to verify if approvals were made by authorized approvers.
• Use network monitoring tools to capture and analyze Discord traffic for suspicious approval commands originating from low-privilege users.

Specific commands depend on your environment and logging setup, but example commands might include:

• Using Discord bot or API logs: `grep '/approve' discord_message_logs.log | grep -v 'authorized_approver_usernames'`
• Using OpenClaw logs: `grep 'exec approval' openclaw.log | grep -v 'authorized_approver_usernames'`

Useful 0 Not Useful 0