| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | ≥ 2026.2.14, < 2026.3.28 | 2026.3.28 |
| openclaw | ≥ 2026.2.14, < 2026.3.28 | 2026.3.28 |
Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages.
Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy.
extensions/discord/src/monitor/agent-components.ts
>= 2026.2.14, <= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 511093d4b3 (Discord: apply component interaction policy gates).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free