CVE-2026-41331

CVE-2026-41331 is a resource consumption vulnerability affecting OpenClaw versions prior to 2026.3.31, specifically in the Telegram audio preflight transcription functionality. The flaw allows unauthorized group senders to bypass allowlist enforcement and trigger resource-intensive transcription processing, potentially leading to unauthorized resource or billing consumption. The vulnerability has a CVSS score of 5.3 (Medium severity) and can be exploited remotely over the network without authentication or user interaction required. Attack complexity is low, meaning it can be readily exploited by threat actors with minimal effort. The impact is limited to availability concerns rather than confidentiality or integrity breaches, though the financial impact through billing consumption could be significant for affected organizations. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00037 indicates very low probability of exploitation in real-world conditions. Community attention remains low as indicated by the inactive status on security hot lists, suggesting this is not a widely publicized threat at this time.