OpenClaw Discord Bot Vulnerability Allows Unauthorized Exec Approvals

The National Vulnerability Database (NVD) has detailed CVE-2026-41303, a high-severity authorization bypass in OpenClaw before version 2026.3.28. This flaw specifically impacts Discord text approval commands, allowing individuals not designated as approvers to resolve pending execution approvals. This is a critical bypass that subverts established security controls.

Attackers can exploit this vulnerability by sending crafted Discord text commands. This action allows them to circumvent the channels.discord.execApprovals.approvers allowlist, effectively granting them the ability to approve pending host execution requests. The CVSS score for this vulnerability is 8.8 (HIGH), reflecting significant impact on confidentiality, integrity, and availability.

This isn’t just a Discord bot misconfiguration; it’s a direct route to unauthorized code execution. If your organization uses OpenClaw for managing critical operations via Discord, this vulnerability represents a severe risk. It undermines the very concept of segregated duties and controlled execution environments. Defenders need to recognize that an attacker gaining this capability could bypass critical gates, leading to full system compromise or data exfiltration.