CVE-2026-41303
Authorization Bypass in OpenClaw Discord Exec Approval Commands
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized users sending Discord text commands to bypass the approver allowlist and approve pending host execution requests in OpenClaw versions prior to 2026.3.28.
To detect exploitation attempts on your system or network, monitor Discord text commands related to execution approvals, especially the `/approve` command, for usage by users who are not in the configured approvers allowlist.
Suggested detection steps include:
- Review Discord logs or message histories for `/approve` commands issued by unauthorized users.
- Audit OpenClaw logs for execution approval events and correlate them with user identities to verify if approvals were made by authorized approvers.
- Use network monitoring tools to capture and analyze Discord traffic for suspicious approval commands originating from low-privilege users.
Specific commands depend on your environment and logging setup, but example commands might include:
- Using Discord bot or API logs: `grep '/approve' discord_message_logs.log | grep -v 'authorized_approver_usernames'`
- Using OpenClaw logs: `grep 'exec approval' openclaw.log | grep -v 'authorized_approver_usernames'`
Can you explain this vulnerability to me?
CVE-2026-41303 is a high-severity authorization bypass vulnerability in OpenClaw versions before 2026.3.28. It affects the Discord text approval commands by allowing unauthorized users to bypass the approver allowlist configured in channels.discord.execApprovals.approvers.
This flaw enables attackers with low privileges to send Discord text commands that resolve pending host execution approvals without proper authorization, effectively granting them approval capabilities they should not have.
The vulnerability is classified under CWE-863 (Incorrect Authorization) and was fixed in OpenClaw version 2026.3.28.
How can this vulnerability impact me? :
This vulnerability allows attackers with minimal privileges to bypass authorization controls and approve pending execution requests on hosts.
- Unauthorized users can execute commands that should be restricted to authorized approvers.
- It can lead to unauthorized data access, modification, and potential disruption of service.
Because the attacker can approve execution requests without proper authorization, this poses a significant security risk, potentially allowing malicious actions on affected systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-41303 vulnerability, you should immediately upgrade OpenClaw to version 2026.3.28 or later, where the authorization bypass flaw in Discord text approval commands has been fixed.
This update enforces proper approver checks for the channels.discord.execApprovals.approvers allowlist, preventing unauthorized users from approving pending execution requests.
Until the update can be applied, restrict access to the Discord text approval commands and monitor for any unauthorized approval activities.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-41303 is an authorization bypass vulnerability that allows unauthorized users to approve pending execution requests in OpenClaw's Discord integration. This flaw can lead to unauthorized execution of commands, potentially resulting in unauthorized access, modification, or disruption of sensitive data or services.
Such unauthorized actions could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. The vulnerability's high severity and potential for unauthorized data access and modification indicate a risk of violating these regulatory requirements.