CVE-2026-41367: OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions
OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.28
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41367?
CVE-2026-41367 is classified as a medium severity vulnerability due to its potential to bypass policy enforcement in Discord component interactions.
How do I fix CVE-2026-41367?
To fix CVE-2026-41367, upgrade OpenClaw to version 2026.3.28 or later, which resolves the policy enforcement bypass issue.
What versions of OpenClaw are affected by CVE-2026-41367?
CVE-2026-41367 affects OpenClaw versions 2026.2.14 through 2026.3.24.
What are the implications of CVE-2026-41367 for users?
Users of affected OpenClaw versions may face unauthorized access to privileged actions via Discord component interactions.
How can I determine if my OpenClaw installation is vulnerable to CVE-2026-41367?
You can determine if your OpenClaw installation is vulnerable by checking the version against the affected versions listed for CVE-2026-41367.