CVE-2026-100526 Overview
CVE-2026-100526 affects the OpenClaw Discord integration distributed as the npm package @openclaw/discord. Versions prior to 2026.9.3 lose the sender-scoped media policy when handling emoji and sticker upload actions. The flaw lets an authenticated sender with access to guild asset actions cause OpenClaw to read a local host path that the configured media roots would normally reject. The bytes from that out-of-policy file are then placed into an outbound emoji or sticker upload. Exploitation requires both guild asset action access and knowledge of a useful local path. The issue does not permit unrestricted filesystem browsing or arbitrary code execution. The weakness is classified as [CWE-862] Missing Authorization and is fixed in @openclaw/discord version 2026.9.3.
Critical Impact
An authenticated sender can exfiltrate specific local files through emoji or sticker uploads by bypassing the per-sender media root policy.
Affected Products
- @openclaw/discord npm package versions prior to 2026.9.3
- OpenClaw deployments integrating Discord guild asset actions
- Hosts running OpenClaw with configured sender-scoped media roots
Discovery Timeline
- 2026-09-26 - CVE-2026-100526 published to the National Vulnerability Database (NVD)
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100526
Vulnerability Analysis
The vulnerability resides in the emoji and sticker upload handlers of the @openclaw/discord integration. OpenClaw applies a sender-scoped media policy that restricts which local filesystem paths a sender can reference when uploading assets. In vulnerable builds, that policy is dropped before the handler loads the local file. The handler consequently reads a path that the sender's configured media roots should block. The file bytes are then forwarded to Discord as part of an emoji or sticker upload payload. The impact is confined to confidentiality of selectable local files reachable by the OpenClaw process.
Root Cause
The root cause is a missing authorization check [CWE-862] in the guild asset action path. The upload actions bypass the sender-scoped media root validation that other media actions enforce. Policy state is not propagated into the code path that resolves and reads the local file. The handler trusts the supplied path and loads it directly from disk.
Attack Vector
An attacker must already be a sender permitted to invoke the emoji or sticker upload action in a guild served by OpenClaw. The attacker supplies or derives a local filesystem path on the OpenClaw host that falls outside the sender's allowed media roots. OpenClaw reads the file and transmits its contents to Discord as the uploaded emoji or sticker. The attacker then retrieves the asset from Discord to recover the file bytes. The attack does not grant directory listing, arbitrary code execution, or privilege escalation on the host.
No verified proof-of-concept code is publicly available. For technical specifics, consult the GitHub Security Advisory GHSA-xvwp-wmh2-fq48 and the VulnCheck Advisory on Discord Vulnerability.
Detection Methods for CVE-2026-100526
Indicators of Compromise
- Emoji or sticker upload events in OpenClaw logs that reference local paths outside configured sender media roots.
- Discord audit log entries showing unexpected guild emoji or sticker additions tied to a single sender.
- Process-level file reads by the OpenClaw Node.js process targeting configuration files, key material, or user data directories.
Detection Strategies
- Correlate OpenClaw action logs with filesystem access telemetry to identify upload actions that resolve paths outside allowed media roots.
- Alert on uploaded emoji or sticker assets whose binary content matches signatures of sensitive file types such as .env, .pem, or SQLite databases.
- Review npm dependency manifests across managed hosts to flag @openclaw/discord installations below version 2026.9.3.
Monitoring Recommendations
- Enable verbose audit logging for guild asset actions and ship logs to a centralized SIEM for retention and correlation.
- Monitor outbound Discord API calls for POST /guilds/{guild.id}/emojis and POST /guilds/{guild.id}/stickers and baseline their volume per sender.
- Track file read syscalls originating from the OpenClaw service account and alert on access to paths outside the declared media roots.
How to Mitigate CVE-2026-100526
Immediate Actions Required
- Upgrade @openclaw/discord to version 2026.9.3 or later across all OpenClaw deployments.
- Audit which senders currently hold permission to invoke emoji and sticker upload actions and revoke access that is not required.
- Review Discord guild emoji and sticker libraries for assets uploaded by vulnerable installations and remove any that contain sensitive data.
Patch Information
The maintainers released a fix in @openclaw/discord2026.9.3. The patch restores enforcement of the sender-scoped media policy in the emoji and sticker upload code paths. See the GitHub Security Advisory GHSA-xvwp-wmh2-fq48 for release notes and commit references.
Workarounds
- Disable the guild emoji and sticker upload actions in OpenClaw configuration until the patched version is deployed.
- Restrict the OpenClaw process account using operating system file permissions so it cannot read sensitive files outside its intended data directory.
- Narrow the set of senders permitted to invoke guild asset actions to a minimal trusted group.
# Upgrade the vulnerable package to the fixed release
npm install @openclaw/discord@2026.9.3
# Verify the installed version
npm ls @openclaw/discord
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.