PT-2026-26409 · Discord+1 · Discord+1

Tdjackey · CVE-2026-32028 · Publicado 2026-03-03 · Atualizado 2026-03-20

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.25

Description OpenClaw versions prior to 2026.2.25 do not consistently enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications. This allows users not included in the allowlist to enqueue reaction-derived system events. Attackers can exploit this inconsistency by reacting to bot-authored direct messages to bypass authorization restrictions and potentially trigger downstream automation or tool policies. The issue relates to an inconsistency in authorization checks between normal direct message ingress and reaction-notification paths. The fix aligns reaction ingress with normal message preflight for Discord DM/group-DM/guild policy boundaries.

Recommendations Update OpenClaw to version 2026.2.25 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-32028

GHSA-354R-7MFH-7RH2

Produtos afetados

Discord

Openclaw

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32028.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-354r-7mfh-7rh2 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e · Correção
• https://osv.dev/vulnerability/GHSA-354r-7mfh-7rh2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32028 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-missing-authorization-check-in-discord-dm-reaction-ingress · Nota
• https://osv.dev/vulnerability/CVE-2026-32028 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891588724314479 · Publicação no Twitter