OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions.
Date: 2026-04
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-33579
CVE-2026-33580
CVE-2026-34504
CVE-2026-41294
CVE-2026-41367
CVE-2026-41371
CVE-2026-41380
CVE-2026-41390
CWE: CWE-15
CWE-284
CWE-307
CWE-807
CWE-862
CWE-863
CWE-918
CVSS: 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.


Mitigations:

Architectural layers (MAESTRO):