CVE-2026-41303

HIGH

OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-41303. PoCs published by kaleth4.

AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2026-41303, an authorization bypass vulnerability in OpenClaw Discord Bot versions prior to 2026.3.28. The exploit demonstrates how unauthorized users can approve pending execution requests by sending crafted API requests.

Description

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.

Exploits (1)

nomisec WORKING POC
by kaleth4 · poc
https://github.com/kaleth4/CVE-2026-41303

The repository contains a functional Python exploit for CVE-2026-41303, an authorization bypass vulnerability in OpenClaw Discord Bot versions prior to 2026.3.28. The exploit demonstrates how unauthorized users can approve pending execution requests by sending crafted API requests.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: OpenClaw Discord Bot < 2026.3.28
Auth required
Prerequisites: Discord user token with access to the target channel · ID of the pending approval · ID of the Discord channel
devstral-2 · analyzed Apr 24, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-98hh-7ghg-x6rq)
https://github.com/openclaw/openclaw/security/advisories/GHSA-98hh-7ghg-x6rq
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands
https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-discord-text-approval-commands

Scores

CVSS v3 8.8
EPSS 0.0008
EPSS Percentile 23.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (4)
npm/openclaw 0 - 2026.3.28npm
OpenClaw/OpenClaw < 2026.3.28
openclaw/openclaw < 2026.3.28
OpenClaw/OpenClaw 2026.3.28
Published Apr 21, 2026
Tracked Since Apr 21, 2026