https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:49:19.673535+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41374 CVE-2026-41374 — OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization 2026-10-03T11:49:19.675110+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

 https://cve.radiocsirt.org/vuln/ghsa-hhff-fj5f-qg48 GHSA-hhff-fj5f-qg48 — OpenClaw runs Discord audio preflight transcription before member authorization 2026-10-03T11:49:19.675164+00:00

Affected: npm: openclaw

## Summary Discord audio preflight transcription before member authorization

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still runs Discord audio preflight before member allowlist rejection, but this is the same pre-auth resource-consumption class and not the high-severity auth-bypass framing in the draft.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `ee52f64226a03efadfdf1e3b759e13424a3d4e41` — 2026-03-30T14:38:22+01:00

OpenClaw thanks @AntAISecurityLab for reporting.