CVE-2026-27484: OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows
Overview
Discord moderation action handling (timeout, kick, ban) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.
Impact
In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields.
Affected Packages / Versions
- Package: openclaw (npm) - Latest published affected version (as of 2026-02-19): 2026.2.17 - Affected range: <=2026.2.17 - Fixed in planned next release: 2026.2.18
Fix
- Moderation authorization now uses trusted sender context (requesterSenderId) instead of untrusted action params. - Added permission checks for required guild capabilities per action.
Fix Commit(s)
- 775816035ecc6bb243843f8000c9a58ff609e32d
Thanks @aether-ai-agent for reporting.
Other sources
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27484?
CVE-2026-27484 is classified as a medium severity vulnerability due to the potential for unauthorized Discord moderation actions.
How do I fix CVE-2026-27484?
To fix CVE-2026-27484, upgrade to version 2026.2.19 or later of the openclaw package.
What software is affected by CVE-2026-27484?
CVE-2026-27484 affects the openclaw package versions prior to 2026.2.19.
What type of vulnerability is CVE-2026-27484?
CVE-2026-27484 is a security vulnerability related to Discord moderation action handling.
What are the potential impacts of CVE-2026-27484?
The potential impacts of CVE-2026-27484 include unauthorized moderation actions, such as timeout, kick, or ban actions using forged identities.