OpenClaw (also known as Moltbot or Clawdbot) is a self-hosted personal AI assistant that integrates with various messaging platforms and mobile or desktop operating systems to provide voice and text interactions. The architecture separates the control plane from the assistant, allowing users to host the technology on their own devices while utilizing live canvas rendering.

OpenClaw (formerly Moltbot or Clawdbot)

## Summary
Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.
## Impact
A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.
## Affected Component
`extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts`
## Fixed Versions
- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.
## Fix
Fixed by commit `355abe5eba` (`Discord: enforce approver checks for text approvals`).

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2026-77301	HIGH	7.5	JavaScript	openclaw	No	Yes	Sep 18, 2026
CVE-2026-84375	HIGH	7.5	JavaScript	subscription-manager-initial-setup-addon	No	Yes	Sep 01, 2026
CVE-2026-84365	MEDIUM	6.5	JavaScript	kibana-9.4	No	Yes	Sep 01, 2026
CVE-2026-84373	MEDIUM	5.9	JavaScript	langfuse-fips-4	No	Yes	Sep 01, 2026
CVE-2026-84371	MEDIUM	5.4	JavaScript	unleash	No	Yes	Sep 01, 2026

GHSA-98hh-7ghg-x6rq:
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

Summary

Impact

Affected Component

Fixed Versions

Fix

8.7

Related OpenClaw (formerly Moltbot or Clawdbot) vulnerabilities:

Benchmark your Cloud Security Posture

Additional Wiz resources

Cloud Vulnerability DB

Cloud Threat Landscape

PEACH

Ready to see Wiz in action?

GHSA-98hh-7ghg-x6rq: OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation