In short
- CVE-2026-41341 is a MEDIUM (CVSS 5.4) vulnerability affecting openclaw (openclaw), openclaw.
- Chance of exploitation in the next 30 days (EPSS): 0.13%, higher than 2.3% of all vulnerabilities.
- Fix: update to 2026.3.31 or later.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Discord Component Interaction Misclassifies Group DM as Direct Message
Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: Real on shipped v2026.3.24 component-interaction routing/auth in extensions/discord/src/monitor/agent-components-helpers.ts, but impact is limited to Group DM policy or session misclassification.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
8c83128fc38d5a3642b8ccbea58550755fdbbbaf — 2026-03-30T11:17:53-06:00
Release Process Note
- The fix is already present in released version
2026.3.31.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @nexrin for reporting.
NVD description
OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this misclassification to bypass group DM policy enforcement or trigger incorrect session handling.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free