CVE-2026-32028
CVE-2026-32028 · OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users to enqueue reaction-derived system events. Attackers can exploit this inconsistency by reacting to bot-authored DM messages to bypass DM authorization restrictions and trigger downstream automation or tool policies.
CVSS 6.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-354r-7mfh-7rh2
- https://github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e
- https://www.vulncheck.com/advisories/openclaw-missing-authorization-check-in-discord-dm-reaction-ingress
- https://nvd.nist.gov/vuln/detail/CVE-2026-32028