p PatchFirst

CVE-2026-41367

CVE-2026-41367 · OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 2026.2.14, < 2026.3.28: Affected (semver)
    • 2026.3.28: Not affected (semver)

    Update to 2026.3.28

  • openclaw npm

    Affected ranges
    • SEMVER: ≥ 2026.2.14, < 2026.3.28

    Update to 2026.3.28

Original sources

Check your server →