CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2026-41331
Medium (6.9) in openclaw openclaw. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.31.
OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist enforcement to cause resource or billing consumption by initiating audio preflight operations before authorization checks are applied.
Severity
CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-408
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m6fx-m8hc-572m | npm | openclaw | <2026.3.31 | 2026.3.31 |