CVE-2026-41348: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41348 is an authorization bypass vulnerability in OpenClaw, an npm package, affecting all versions prior to 2026.3.31. The flaw exists in Discord slash command and autocomplete interaction paths that fail to enforce group DM channel allowlist restrictions, allowing already-authorized Discord users to access restricted group DM channels without proper authorization checks. It was published on April 23, 2026, with a patch released on March 31, 2026 (commit 8fdb196). The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, OpenClaw Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the native Discord slash command dispatch path and autocomplete handler in extensions/discord/src/monitor/native-command.ts only checked whether group DMs were globally enabled (groupEnabled === false) but did not validate whether the specific channel ID or name appeared in the configured groupChannels allowlist. This meant any authorized Discord user could invoke a slash command or trigger autocomplete from a non-allowlisted group DM channel and have it processed normally. The fix introduced a dedicated resolveDiscordNativeGroupDmAccess() function that checks both the groupEnabled flag and the groupChannels allowlist before dispatching or returning autocomplete results (OpenClaw Advisory, Fix Commit).

Successful exploitation allows an authenticated Discord user to bypass channel access controls and interact with restricted group DM channels that should be blocked by the allowlist configuration. This results in low-impact confidentiality and integrity consequences — the attacker can read channel data and potentially modify it (e.g., invoke commands that alter state) without proper authorization. Availability is not affected, and there is no impact on systems beyond the vulnerable OpenClaw instance itself (Github Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low-level privileges (the attacker must already be an authorized Discord user) and specific deployment conditions (a group DM allowlist must be configured), which limits the attack surface. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, OpenClaw Advisory).

1. Prerequisite: Obtain authorized Discord user credentials or access to an account that is permitted to interact with the target OpenClaw bot (i.e., listed in commands.allowFrom.discord).
2. Identify target: Determine that the OpenClaw deployment has group DM functionality enabled (dm.groupEnabled: true) with a restricted groupChannels allowlist configured.
3. Initiate group DM: Create or join a Discord group DM channel that is NOT listed in the groupChannels allowlist of the target OpenClaw instance.
4. Invoke slash command: From the non-allowlisted group DM channel, invoke any OpenClaw Discord slash command (e.g., /think, /status) or trigger an autocomplete interaction. In vulnerable versions (≤2026.3.28), the allowlist check is absent from the dispatch and autocomplete paths.
5. Access restricted channel: The command is processed normally without rejection, granting the attacker the ability to read responses and interact with the bot as if the channel were authorized (OpenClaw Advisory, Fix Commit).

• Logs: OpenClaw application logs showing slash command dispatch or autocomplete responses originating from group DM channel IDs not present in the configured groupChannels allowlist.
• Discord Activity: Slash command invocations (e.g., /think, /status, /acp) from unexpected group DM channels by authorized users; autocomplete interactions returning results in non-allowlisted group DM contexts.
• Configuration Review: Discrepancy between the dm.groupChannels allowlist entries and the channel IDs appearing in command interaction logs.

Upgrade OpenClaw (npm package) to version 2026.3.31 or later, which contains the fix introduced in commit 8fdb19676ab44cf85d47ee13c578195f2e527591. No configuration-based workaround is available for versions ≤2026.3.28 other than disabling group DM functionality entirely (dm.groupEnabled: false). After upgrading, review and validate the dm.groupChannels allowlist configuration to ensure only intended channels are permitted (OpenClaw Advisory, Fix Commit).

The vulnerability was reported by researcher nexrin and sponsored by KeenSecurityLab and qclawer. The maintainer triage assessed the impact as narrow, noting that exploitation is limited to already-authorized Discord users bypassing a channel restriction rather than crossing a stronger trust boundary. No significant broader media coverage or social media discussion has been observed (OpenClaw Advisory).