Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

GHSA-4cqv-h74h-93j4: OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

mediumCVSS 3.1 6.5

OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.

Published Mar 3, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
<= 2026.2.21-2
Fixed in
2026.2.22
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.21-2
  • Patched versions: >= 2026.2.22

What Changed

  • openclaw security audit now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel users, and pairing-store entries).
  • Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config files on disk.
  • Name-based entries remain supported for compatibility.

Recommendations

  • Prefer stable Discord user IDs for security-sensitive allowlists.
  • Run openclaw security audit and address warnings where practical.

Fix Commit(s)

  • f97c45c5b5e0698b6667bb5f6badc0cac7dabd12
  • 747bb581b3f2264495e1fec5a0727d9f2ca1b6f1

OpenClaw thanks @tdjackey for reporting.

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries