PT-2026-34772 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-03 · Updated 2026-04-25 · CVE-2026-41341

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A logic error exists in the Discord component interaction routing within the file extensions/discord/src/monitor/agent-components-helpers.ts. This issue causes group direct messages to be misclassified as direct messages, which allows attackers to bypass group DM policy enforcement or trigger incorrect session handling.

Recommendations Update to version 2026.3.31.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-351

CWE-863

Related Identifiers

CVE-2026-41341

GHSA-6336-QQW9-V6X6

GHSA-PR66-WHQJ-RQ5P

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6336-qqw9-v6x6 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8c83128fc38d5a3642b8ccbea58550755fdbbbaf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41341 · Security Note
• https://osv.dev/vulnerability/GHSA-6336-qqw9-v6x6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pr66-whqj-rq5p · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://twitter.com/CVEnew/status/2048168367048273930 · Twitter Post
• https://vulncheck.com/advisories/openclaw-component-interaction-misclassification-in-discord-extension · Note