Executive brief
OpenClaw is an AI automation platform that integrates with Discord to process messages and reactions. A flaw in the reaction handling system allowed unauthorized Discord guild members to submit reaction events that bypassed security allowlists, potentially injecting reaction data into sessions where those users should not have access. This could lead to unauthorized commands being executed or data being modified by users without proper permissions.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the Discord reaction ingestion path. While normal inbound guild messages enforced member-level users and roles allowlist checks, the reaction ingress handler did not apply the same authorization gates. A non-allowlisted guild member could trigger reaction events that were accepted and queued as trusted system events for downstream session processing. The flaw required the attacker to be a member of a Discord guild connected to the OpenClaw instance and able to post reactions, but no special privileges were required. The fix, released in version 2026.3.11, applies the same allowlist enforcement to guild reaction events that normal messages already use.
Affected products
- OpenClaw openclaw < 2026.3.11
Timeline
- 2026-03-13: disclosed
- 2026-03-11: patched: Fix released in version 2026.3.11