Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2026-32035

OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron functionality in mixed-trust channels.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.2affected
  • 2026.3.2unaffected
pkg:npm/openclaw

References