CVE-2026-27484 OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

Low 2.3 Published 21 Feb 2026 Updated 24 Feb 2026

Non-admin users can spoof sender identity to perform Discord moderation actions like bans or kicks if moderation features are enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-27484?

CVE-2026-27484 is a low-severity missing authorization vulnerability in Openclaw Openclaw, published on 21 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.

Weakness: CWE-862

Which versions are affected by CVE-2026-27484?

2 open source packages ship an affected version, including openclaw. It affects 1 product.

Package	Affected	Fixed in
`openclaw` npm	All versions	`2026.2.18`
`openclaw` npm	All versions	`2026.2.18`

Products include Openclaw Openclaw.

How do I fix CVE-2026-27484?

Upgrade openclaw to 2026.2.18 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-27484 being exploited?

There is no known exploitation of CVE-2026-27484 in the wild and no public exploit code.

All Openclaw Openclaw vulnerabilities

Sources

Also known as GHSA-wh94-p5m6-mr7j, MINI-h26v-jmmg-v3mj.