https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:52:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-41303 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.</p> https://vulnerability.circl.lu/vuln/cve-2026-41303 https://vulnerability.circl.lu/vuln/ghsa-98hh-7ghg-x6rq <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.</p> <p>## Impact</p> <p>A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.</p> <p>## Affected Component</p> <p>`extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `355abe5eba` (`Discord: enforce approver checks for text approvals`).</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.</p> <p>## Impact</p> <p>A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.</p> <p>## Affected Component</p> <p>`extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `355abe5eba` (`Discord: enforce approver checks for text approvals`).</p> https://vulnerability.circl.lu/vuln/ghsa-98hh-7ghg-x6rq