CVE-2026-41374CWE-408

OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization

Medium · published April 28, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00654 · 50.7th percentile
Weakness
CWE-408 · Incorrect Behavior Order: Early Amplification
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization
    cvelistv5