CVE-2026-41348: OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands

Q: What is the severity of CVE-2026-41348?

CVE-2026-41348 has been classified as a medium severity vulnerability.

Q: How do I fix CVE-2026-41348?

To fix CVE-2026-41348, upgrade OpenClaw to version 2026.3.31 or later.

Q: What kind of vulnerability is CVE-2026-41348?

CVE-2026-41348 is an authorization bypass vulnerability affecting group DM channel allowlist enforcement.

Q: Who is affected by CVE-2026-41348?

Authorized Discord users with OpenClaw versions prior to 2026.3.31 are affected by CVE-2026-41348.

Q: What can attackers do with CVE-2026-41348?

Attackers can exploit CVE-2026-41348 to bypass group DM channel allowlist restrictions and access restricted areas.

Published Apr 23, 2026

Updated

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. Authorized Discord users can bypass channel restrictions by invoking slash commands, allowing access to restricted group DM channels.

Affected Software

2 affected components

OpenClaw OpenClaw<2026.3.31

OpenClaw Openclaw Node.js<2026.3.31

Remediation

Patch Available

https://github.com/openclaw/openclaw/commit/8fdb19676ab44cf85d47ee13c578195f2e527591

Event History

Apr 23, 2026

CVE Published

via MITRE·09:58 PM

Data Sourced

via MITRE·09:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-41348?

CVE-2026-41348 has been classified as a medium severity vulnerability.

How do I fix CVE-2026-41348?