VulnerabilityAnalyzed

CVE-2026-41367

Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

MEDIUM 5.3EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: openclaw/openclaw
Source: disclosure@vulncheck.com

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-jp4j-q5fc-58gvVendor Advisory
https://www.vulncheck.com/advisories/openclaw-policy-enforcement-bypass-in-discord-component-interactionsThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.