OpenClaw versions up to 2026.3.28 have a vulnerability where Discord slash commands bypass the group DM channel allowlist. This allows authorized Discord users to bypass channel restrictions within group DMs. The issue is fixed in version 2026.3.31. The vulnerability has moderate severity with limited impact confined to users already authorized in the group DM.