Junglewise Threat Intelligence

CVE-2026-41374: OpenClaw Discord audio transcription before member authorization

CVE-2026-41374 · Severity: low · CVSS 3.1 · Published 2026-04-03

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a Discord bot library that performs audio transcription on incoming voice messages. The vulnerability allows the bot to begin processing and transcribing audio before verifying that the message sender is an authorized member, which can lead to resource exhaustion as attackers send audio repeatedly without authorization checks.

Technical details

OpenClaw processes Discord audio preflight transcription operations before validating member authorization status. The vulnerability is classified as a pre-authentication resource-consumption issue (CWE-408, CWE-770). Attackers can trigger expensive transcription operations on the bot without membership verification, exhausting CPU, memory, and API quota resources. The attack requires network access to a Discord server where the vulnerable bot is deployed, with no authentication or user interaction required from the attacker's side. The flaw has been patched in version 2026.3.31 and later.

Affected products

  • OpenClaw OpenClaw <=2026.3.28

Timeline

  • 2026-04-03: disclosed: Vulnerability published via GitHub Security Advisory
  • 2026-03-31: patched: Fix released in version 2026.3.31

References

Related threats