CVE-2026-100583: OpenClaw Discord before 2026.7.1 Authorization Bypass

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-10-08
Weakness: CWE-862

Description

OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata from servers or channels outside the operator's allowlist.

Affected products

openclaw discord: before 2026.7.1 — fixed in 2026.7.1

How to fix

Upgrade to a fixed version: openclaw discord 2026.7.1. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-35wj-hm2r-ghgw
https://www.vulncheck.com/advisories/openclaw-discord-before-2026.7.1-authorization-bypass

Get alerted when CVE-2026-100583 or the next vulnerability affects your stack