CVE-2026-41367
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.
Risk Assessment
Attackers can perform privileged actions in Discord that should be blocked, potentially leading to unauthorized access to functions or data.
Recommendation
Update OpenClaw to a version newer than 2026.3.24 that includes a policy enforcement fix.
Original NVD description (English source)
OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.