| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.
A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.
extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 355abe5eba (Discord: enforce approver checks for text approvals).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free