OpenClaw versions prior to 2026.3.31 perform Discord audio preflight transcription before checking whether a member is authorized, allowing an unauthenticated remote attacker to trigger this costly processing. The weakness is identified as CWE‑408 and carries a CVSS score of 6.9, indicating a moderate severity vulnerability that can lead to resource exhaustion and disruption of service availability.

The vulnerability affects the OpenClaw product from the vendor OpenClaw. All releases before 2026.3.31 are impacted, as indicated by the advisory and the commit in the upstream repository.

The flaw can be exploited by any remote host that can reach the OpenClaw instance because no authentication is required before the audio preflight is initiated. EPSS data is not available, so the exact exploitation probability is unknown, yet the lack of authentication makes the attack surface broad. The vulnerability is not yet listed in the CISA KEV catalog. Given its moderate CVSS score of 6.9, the risk is considered significant, especially in environments where OpenClaw is exposed to the public internet.