CVE-2026-41381

5.4 Moyenne

Publiée le 28/04/2026 à 21:37 · Modifiée le 17/06/2026 à 12:46 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to restricted voice channels.

Traduire en français

Produits concernés

OpenClaw
Openclaw openclaw

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.3 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-cqgw-44wg-44rf Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-access-control-bypass-in-discord-voice-manager-via-channel-allowlist Third Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories