CVE-2026-27484

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Missing Authorization pada openclaw. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wh94-p5m6-mr7j advisory vendor
• https://github.com/openclaw/openclaw/commit/775816035ecc6bb243843f8000c9a58ff609e32d patch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.19 release notes