En bref
- CVE-2026-41303 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.41%, plus élevée que 35.1% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.28 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.28
| 2026.3.28
|
| openclaw npm | < 2026.3.28
| 2026.3.28
|
Description
Summary
Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.
Impact
A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.
Affected Component
extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts
Fixed Versions
- Affected:
<= 2026.3.24
- Patched:
>= 2026.3.28
- Latest stable
2026.3.28 contains the fix.
Fix
Fixed by commit 355abe5eba (Discord: enforce approver checks for text approvals).
NVD description
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free