CVE-2026-41348 LOW

CVE-2026-41348: OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands

Vendor Openclaw

Product OpenClaw

Weakness CWE-863 · Incorrect authorization

Published April 23, 2026

Last update April 24, 2026

View on NVD All CVEs

CVSS base score

2.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. Authorized Discord users can bypass channel restrictions by invoking slash commands, allowing access to restricted group DM channels.

Key dates

02Disclosure timeline

April 23, 2026 CVE published

April 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41348 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2026-34082 Dify has IDOR in deleting someone else's chat conversation CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom CVE-2025-2515 Bluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies CVE-2026-33424 PM access granted through invites after access revocation CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware