CVE-2026-27484: OpenClaw Discord Moderation Authorization Spoofing Vulnerability
Summary
CVE-2026-27484: OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows. Affects openclaw versions < 2026.2.18. Fixed in 2026.2.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an npm package designed for managing Discord bots, providing functionalities such as moderation actions (timeout, kick, ban) within Discord servers. It allows bot developers to implement various moderation features easily. However, the package has a vulnerability that arises from using untrusted sender identity in moderation actions, which can be exploited by non-admin users.
Vulnerability Detail
The vulnerability in OpenClaw stems from its handling of Discord moderation actions, where it relies on sender identity from request parameters rather than a trusted runtime sender context. This flaw allows non-admin users to spoof sender identity fields and request moderation actions, potentially leading to unauthorized actions within a Discord server. The issue is particularly concerning in setups where moderation actions are enabled and the bot possesses the necessary guild permissions.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.18
This is the first release that contains the fix.
npm install openclaw@2026.2.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the bot's permissions to prevent non-admin users from executing moderation actions until the package is updated. This can be done by adjusting the bot's role settings in the Discord server.
Conclusion
In summary, CVE-2026-27484 is a vulnerability in the OpenClaw package that allows unauthorized moderation actions due to the use of untrusted sender identity. It is crucial to update to version 2026.2.18 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for openclaw →
FAQ
CVE-2026-27484 is a vulnerability in the OpenClaw package that allows non-admin users to spoof sender identity and request unauthorized moderation actions.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package right away, consider restricting the bot's permissions to prevent non-admin users from executing moderation actions as a temporary measure.
The vulnerability can lead to unauthorized moderation actions being performed by non-admin users, which can disrupt server management and user experience.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
