CVE-2026-41367
Bypass of Channel Policy Enforcement in OpenClaw Discord Components
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | From 2026.2.14 (inc) to 2026.3.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade OpenClaw to version 2026.3.28 or later, where the issue has been fixed by ensuring consistent application of guild and channel policy gates on Discord button and component interactions.
This update prevents attackers with low privileges from bypassing channel policy enforcement and triggering privileged component actions from blocked contexts.
Can you explain this vulnerability to me?
CVE-2026-41367 is a vulnerability in OpenClaw versions 2026.2.14 through 2026.3.24 where the software fails to consistently enforce guild and channel policy gates on Discord button and component interactions.
This means that attackers with low privileges can bypass the intended channel policy restrictions and trigger privileged component actions from contexts that should be blocked.
The root cause is an incorrect authorization check (classified as CWE-863) in the handling of Discord component interactions, allowing unauthorized actions within Discord integrations.
How can this vulnerability impact me? :
This vulnerability allows an attacker with low privileges to remotely exploit the system without any user interaction.
By bypassing guild and channel policy enforcement, the attacker can perform unauthorized modifications through privileged component actions within Discord integrations.
While it does not impact confidentiality or availability, it can lead to integrity issues by allowing unauthorized changes.