CVE-2026-41341lowCWE-351

CVE-2026-41341: fallo de gravedad baja en OpenClaw

OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear OpenClaw+ Monitorear openclaw

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.3epss 0.1%
OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this misclassification to bypass group DM policy enforcement or trigger incorrect session handling.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
OpenClaw · OpenClaw
CVEs relacionadas — OpenClaw

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-25253HIGHCVE-2026-25253EPSS 32.4%CVE-2026-44112HIGHOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge WritesEPSS 7.3%CVE-2026-32917CRITICALOpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCPEPSS 2.0%CVE-2026-53822HIGHOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and ExecutionEPSS 1.1%CVE-2026-32052MEDIUMOpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersEPSS 0.9%CVE-2026-3689MEDIUMOpenClaw Canvas Path Traversal Information Disclosure VulnerabilityEPSS 0.9%