https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T01:33:08.503133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-27484 BREW-openclaw-cli-CVE-2026-27484 — OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows 2026-10-20T01:33:08.504805+00:00

Affected: Homebrew: openclaw-cli

## Overview

Discord moderation action handling (`timeout`, `kick`, `ban`) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.

## Impact

In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Latest published affected version (as of 2026-02-19): `2026.2.17` - Affected range: `<=2026.2.17` - Fixed in planned next release: `2026.2.18`

## Fix

- Moderation authorization now uses trusted sender context (`requesterSenderId`) instead of untrusted action params. - Added permission checks for required guild capabilities per action.

## Fix Commit(s)

- `775816035ecc6bb243843f8000c9a58ff609e32d`

Thanks @aether-ai-agent for reporting.

 https://cve.radiocsirt.org/vuln/cve-2026-27484 CVE-2026-27484 — OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows 2026-10-20T01:33:08.504864+00:00

Affected: openclaw

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.