CVE-2026-41381
CVE-2026-41381 · OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to restricted voice channels.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cqgw-44wg-44rf
- https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759
- https://www.vulncheck.com/advisories/openclaw-access-control-bypass-in-discord-voice-manager-via-channel-allowlist
- https://nvd.nist.gov/vuln/detail/CVE-2026-41381