CVE-2026-32923: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32923 is an authorization bypass vulnerability in OpenClaw's Discord guild reaction ingestion pipeline that fails to enforce member users and roles allowlist checks. Affected versions are all OpenClaw (npm) releases before 2026.3.11. The vulnerability was published on March 29, 2026, with a patch released in version 2026.3.11. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-284 (Improper Access Control). OpenClaw's reaction ingress authorization path correctly enforced DM, group, guild, and channel policy checks, but omitted the member-level users and roles allowlist gate that normal guild-message preflight applies. As a result, a non-allowlisted guild member could trigger Discord reaction events that were accepted and enqueued as trusted system events for the target session, allowing reaction text to be injected into downstream session context. Exploitation requires only low privileges (Discord guild membership) and no user interaction (GitHub Advisory).

Successful exploitation allows a low-privileged, non-allowlisted Discord guild member to inject arbitrary reaction text into downstream session context, bypassing the configured users and roles allowlist. This results in limited confidentiality and integrity impacts — unauthorized data access and modification of session state — with no availability impact. The scope is unchanged, meaning the impact is confined to the OpenClaw application's session handling rather than broader system compromise (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a target OpenClaw deployment (npm package) running a version prior to 2026.3.11 that is connected to a Discord guild with a configured users and roles allowlist.
2. Join the target guild: Obtain Discord guild membership as a non-allowlisted user — no special privileges beyond basic guild membership are required.
3. Trigger a reaction event: Add a Discord reaction (emoji) to a message in a guild channel monitored by the OpenClaw bot. Because the reaction ingress path does not apply the member-level allowlist check, the event is accepted.
4. Event accepted as trusted: The reaction event is enqueued by OpenClaw as a trusted system event for the routed session, bypassing the allowlist enforcement that would normally block this member.
5. Inject into session context: The reaction text is injected into the downstream session context, potentially influencing application behavior or accessing session-scoped data (GitHub Advisory).

• Logs: OpenClaw application logs showing reaction events from Discord guild members not present in the configured users or roles allowlist being accepted and enqueued as trusted system events.
• Application Behavior: Unexpected or anomalous entries in downstream session context originating from reaction events rather than standard guild messages.
• Discord Audit Logs: Reaction activity from guild members who are not on the allowlist, particularly if correlated with unusual OpenClaw session behavior.

The primary remediation is to upgrade OpenClaw (npm) to version 2026.3.11 or later, which applies the same users and roles allowlist enforcement to guild reaction ingress that already existed for normal inbound guild messages. As interim measures, administrators should restrict Discord guild membership to trusted users only, review and tighten current allowlist configurations, and monitor OpenClaw logs for reaction events from non-allowlisted members. Network-level access controls limiting untrusted guild access to OpenClaw systems can also reduce exposure (GitHub Advisory).