CVE-2026-41303

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Apr 20, 2026
Source updated: Apr 21, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

OpenClaw

Vendor: OpenClaw
Product: OpenClaw
Platforms: Unknown
Default status: unaffected

OpenClaw · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	semver	2026.3.28	Unavailable	None listed
2026.3.28	`unaffected`	semver	Unavailable	Unavailable	None listed