CVE-2026-41374

OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization

Published Apr 28, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

Analysis

Technical impact

OpenClaw versions prior to 2026.3.31 perform Discord audio preflight transcription before checking whether a member is authorized, allowing an unauthenticated remote attacker to trigger this costly processing. The weakness is identified as CWE‑408 and carries a CVSS score of 6.9, indicating a moderate severity vulnerability that can lead to resource exhaustion and disruption of service availability.

Affected Systems

The vulnerability affects the OpenClaw product from the vendor OpenClaw. All releases before 2026.3.31 are impacted, as indicated by the advisory and the commit in the upstream repository.

Risk and Exploitability

The flaw can be exploited by any remote host that can reach the OpenClaw instance because no authentication is required before the audio preflight is initiated. EPSS data is not available, so the exact exploitation probability is unknown, yet the lack of authentication makes the attack surface broad. The vulnerability is not yet listed in the CISA KEV catalog. Given its moderate CVSS score of 6.9, the risk is considered significant, especially in environments where OpenClaw is exposed to the public internet.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.3.31
`2026.3.31`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.3.31)`	affected	generic	['node.js']
`2026.3.31`	unaffected	semver	['node.js']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to OpenClaw 2026.3.31 or later, which removes the preflight processing flaw.
Restrict network access to the OpenClaw service by firewalling or IP whitelisting so that only trusted clients can reach the Discord audio preflight endpoints.
Monitor CPU and memory usage on the OpenClaw server and set alerts for abnormal spikes that may indicate abuse of the preflight feature.

Generated by OpenCVE AI on April 28, 2026 at 23:09 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hhff-fj5f-qg48	OpenClaw runs Discord audio preflight transcription before member authorization

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.474% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/ee52f64226a03efadfdf1e3b759e13424a3d4e41
https://github.com/openclaw/openclaw/security/advisories/GHSA-hhff-fj5f-qg48
https://www.vulncheck.com/advisories/openclaw-resource-consumption-via-discord-audio-preflight-before-member-authorization

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.
Title		OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-408
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/ee52f64226a03efadfdf1e3b759e13424a3d4e41 https://github.com/openclaw/openclaw/security/advisories/GHSA-hhff-fj5f-qg48 https://www.vulncheck.com/advisories/openclaw-resource-consumption-via-discord-audio-preflight-before-member-authorization
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`