Openclaw cli: OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

OpenClaw CLI supports Discord allowlists using user IDs or name/tag entries. Name/tag matching relies on slug normalization, which can cause collisions where distinct user tags map to the same slug, unintentionally satisfying allowlist checks and bypassing authorization controls. This vulnerability affects openclaw versions up to 2026.2.21-2. The patch in 2026.2.22 changes runtime authorization to prefer resolved user IDs when available, mitigating the risk without rewriting config files. The security audit command now warns about name/tag allowlist entries to help users identify potential issues.

An attacker with a Discord user tag that normalizes to the same slug as an allowed name/tag can bypass authorization checks and gain unintended access to features or data protected by the allowlist. The impact includes limited confidentiality and integrity loss but no availability impact. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and partial confidentiality and integrity impact.

A patch is available in openclaw version 2026.2.22 and later. Users should upgrade to this version to mitigate the vulnerability. Additionally, it is recommended to prefer stable Discord user IDs rather than name/tag entries in security-sensitive allowlists. Running the 'openclaw security audit' command will warn about potentially problematic name/tag allowlist entries, which should be addressed where practical.