CVE-2026-41382

2.3 lowEPSS 0.2%

Low (2.3) in openclaw openclaw. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.31.

OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation to gain unauthorized access to restricted voice channels.

Severity

CVSS 4.0

2.3 low

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclaw:openclaw

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-x2m8-53h4-6hch	npm	openclaw	<2026.3.31	2026.3.31

References

https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759
https://github.com/openclaw/openclaw/security/advisories/GHSA-x2m8-53h4-6hch
https://www.vulncheck.com/advisories/openclaw-discord-voice-ingress-authorization-bypass-via-channel-and-role-validation-gaps

Check your stack JSON