OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
Summary
In openclaw@2026.3.1, the Discord voice transcript path called agentCommand(...) without senderIsOwner, and agentCommand defaults missing senderIsOwner to true.
This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (gateway, cron) during voice transcript turns.
Security model note
OpenClaw’s documented trust model is a personal assistant model (one trusted operator), not an adversarial multi-user boundary.
- OpenClaw does not treat one shared gateway/chat surface as a hardened per-user auth boundary.
- Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.
This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.
Details
Relevant path:
- Voice transcript run omitted
senderIsOwnerin Discord voice manager. - Missing
senderIsOwnerdefaulted totrueinagentCommand. - Owner-only tool policy is keyed on
senderIsOwner. gatewayandcronare owner-only tools.
Impact
- Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants.
- No gateway-auth boundary bypass was required.
- Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).
Severity rationale
Downgraded from high to medium to align with OpenClaw’s trust model and deployment assumptions:
- Requires participation in the same voice environment as the trusted operator workflow.
- Requires Discord voice path conditions (joined voice channel + transcript flow).
- Does not introduce a new cross-gateway or unauthenticated boundary bypass.
Remediation
- Always pass explicit
senderIsOwnerfrom Discord voice transcript ingress. - Fail closed (
false) when owner status is unknown for non-local/chat ingress paths. - Keep regression tests that verify owner/non-owner voice speaker handling.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.3.1 - Patched versions:
>= 2026.3.2(released)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | openclaw | < 2026.3.2 | 2026.3.2 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L- Debilidad (CWE)
CWE-269, CWE-863- Plataforma
- npm
- Paquete
openclaw- Publicada
- 03.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-wpg9-4g4v-f9rc - CC BY 4.0
Historial de vulnerabilidades: openclaw
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 588
- Primera → última
- 02.2026 07.2026
- Sin corrección
- 9
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 20
- Alta 215
- Media 299
- Baja 54
Divulgaciones por año
- 2026: 588
-
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.