Every CVE Search/ Get API key

CVE-2026-41367

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

5.3 MediumFix available

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.17%Up 0.1 points since Apr 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Record
CVE-2026-41367
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-25947 5.3

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Record
EUVD-2026-25947
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9xc4-v83w-73v2 5.3

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy...

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Record
GHSA-9xc4-v83w-73v2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
GitHub AdvisoriesGHSA-jp4j-q5fc-58gv 5.3

OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

Summary

Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages.

Impact

Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy.

Affected Component

extensions/discord/src/monitor/agent-components.ts

Fixed Versions

  • Affected: >= 2026.2.14, <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 511093d4b3 (Discord: apply component interaction policy gates).

Record
GHSA-jp4j-q5fc-58gv
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-862
Updated
2026-11-02
NVD 5.3

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Record
CVE-2026-41367
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 5.3

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

Record
CVE-2026-41367
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-jp4j-q5fc-58gv 5.3

OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

Summary

Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages.

Impact

Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy.

Affected Component

extensions/discord/src/monitor/agent-components.ts

Fixed Versions

  • Affected: >= 2026.2.14, <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 511093d4b3 (Discord: apply component interaction policy gates).

Record
GHSA-jp4j-q5fc-58gv
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-862
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 2026.2.14 to 2026.3.24
2026.3.28
openclaw
npm
 2026.2.14 up to 2026.3.28
2026.3.28

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41367 is a medium vulnerability (CVSS 5.3) in Openclaw, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. Fixed in openclaw 2026.3.28.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open