CVE-2026-100583: OpenClaw Discord before 2026.7.1 Authorization Bypass
OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata from servers or channels outside the operator's allowlist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw Discordto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A lower-trust sender with access to interact with the affected OpenClaw Discord deployment can exploit it. The attacker does not need user interaction, but does require low-level privileges.
Are deployments using channel or server allowlists affected?
Yes. The issue specifically bypasses the configured Discord read-target policy for guild metadata read actions, allowing access to metadata from servers or channels outside the operator's allowlist.
What information can be exposed?
The described impact is disclosure of guild metadata that the channel allowlist is intended to exclude. The available data does not indicate integrity or availability impact.
Which versions should be remediated?
OpenClaw Discord versions before 2026.7.1 are affected. Upgrade to version 2026.7.1 or later.