CVE-2026-100546: OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
OpenClaw (npm package openclaw) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a transcript to inherit another speaker's owner status. In Discord agent-proxy voice sessions using the affected realtime control path, an utterance from a non-owner participant could reach the downstream agent boundary marked as owner, so owner-sensitive behavior is applied to the wrong speaker. Exploitation depends on concurrent transcript timing and on the tools and commands available to the affected agent. The issue is fixed in 2026.9.2; as a workaround, disable Discord realtime voice for agents that distinguish owner and non-owner senders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.9.2 - Configuration
Disable Discord realtime voice for agents that distinguish owner and non-owner senders.
OpenClaw Discord agent-proxy voice sessions Discord realtime voice = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use the npm package openclaw at versions 2026.7.2 through versions before 2026.9.2, with Discord agent-proxy voice sessions using the realtime control path. Agents that distinguish owner from non-owner senders are the relevant exposure case.
What does an attacker need to exploit the issue?
A non-owner participant must submit voice transcripts concurrently with other participants so that transcript timing triggers the race condition. The practical impact also depends on the tools and commands available to the affected downstream agent.
What can be done if upgrading is not immediately possible?
Disable Discord realtime voice for agents that distinguish owner and non-owner senders. The issue is fixed in version 2026.9.2.