CVE-2026-41303

CVE-2026-41303 is an authorization bypass vulnerability affecting OpenClaw versions prior to 2026.3.28. The flaw exists in Discord text approval commands and allows unauthorized users to bypass the approver allowlist (channels.discord.execApprovals.approvers) to resolve pending host execution requests that should require explicit authorization. This represents a critical control failure in systems that depend on Discord-based approval workflows. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector requiring minimal complexity and only low privileges to exploit. The impact is severe across confidentiality, integrity, and availability dimensions, as attackers can approve unauthorized command execution on affected hosts. The relatively low EPSS score of 0.0006 suggests this represents a narrower threat across the broader vulnerability landscape. There is currently no evidence of active exploitation, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. Community attention appears limited, with an inactive status on vulnerability tracking lists. Organizations running OpenClaw should prioritize patching to version 2026.3.28 or later to prevent unauthorized approval of critical host execution requests.