6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4cqv-h74h-93j4

GHSA-4cqv-h74h-93j4: OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.21-2
Patched versions: >= 2026.2.22

What Changed

openclaw security audit now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel users, and pairing-store entries).
Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config files on disk.
Name-based entries remain supported for compatibility.

Recommendations

Prefer stable Discord user IDs for security-sensitive allowlists.
Run openclaw security audit and address warnings where practical.

Fix Commit(s)

f97c45c5b5e0698b6667bb5f6badc0cac7dabd12
747bb581b3f2264495e1fec5a0727d9f2ca1b6f1

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4cqv-h74h-93j4

GHSA-4cqv-h74h-93j4:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.21-2	2026.2.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authorization bypass in OpenClaw's Discord integration due to slug collisions from name/tag-based allowlist entries. The analysis of the provided patches pinpoints the vulnerable logic within the function that prepares the allowlist for authorization checks.

The commit 747bb581b3f2264495e1fec5a0727d9f2ca1b6f1 is the primary fix for the runtime vulnerability. It modifies src/discord/monitor/provider.allowlist.ts and src/channels/allowlists/resolve-utils.ts. The key change is within the resolveDiscordAllowlistConfig function. Before the patch, this function would prepare an allowlist that contained the raw, ambiguous name/tag strings from the configuration. This list was then used by a downstream authorization function that performed a comparison based on normalized slugs, which is insecure. The patch alters resolveDiscordAllowlistConfig to use a new canonicalizeAllowlistWithResolvedIds function. This new logic resolves the name/tag entries to their unique Discord user IDs and replaces them in the allowlist that is used for authorization. This ensures that the check is performed against a stable, unique identifier, eliminating the possibility of a slug collision attack.

The other commit, f97c45c5b5e0698b6667bb5f6badc0cac7dabd12, adds a security audit tool to warn users about the presence of these insecure name-based configurations but does not fix the underlying runtime vulnerability. Therefore, resolveDiscordAllowlistConfig is identified as the key function that, prior to being patched, was instrumental in the vulnerability by supplying an insecurely structured allowlist to the authorization process.

Vulnerable functions

resolveDiscordAllowlistConfig

src/discord/monitor/provider.allowlist.ts

This function is responsible for resolving the Discord allowlist configuration at runtime. Prior to the patch, it would process and return a list of allowed users that could contain ambiguous, name-based entries (e.g., 'username#tag'). A separate authorization component would then perform checks by normalizing these names into 'slugs'. The vulnerability arises because different Discord usernames and tags can normalize to the same slug, allowing an attacker to create a username that collides with an authorized user's slug, thus bypassing the authorization check. The patch mitigates this by changing this function to canonicalize the allowlist, replacing the ambiguous names with their unique and stable Discord user IDs before any authorization checks are performed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.