CVE-2026-41303 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.28 contains an authorization bypass caused by improper validation in Discord text approval commands, letting attackers bypass approver allowlist and approve pending exec requests remotely, exploit requires sending crafted Discord commands.

Severity & Score

Impact

Attackers can bypass authorization to approve pending execution requests, potentially leading to unauthorized code execution on hosts.

Mitigation

Update to version 2026.3.28 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-98hh-7ghg-x6rq
• https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-discord-text-approval-commands

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner