CVE-2026-100546 Overview
CVE-2026-100546 is a race condition in the OpenClaw npm package (openclaw) affecting versions >= 2026.7.2 and < 2026.9.2. The flaw resides in the Discord realtime voice transcript path used by agent-proxy voice sessions. Concurrent control-classified voice transcripts can consume speaker context belonging to another participant after an asynchronous control check. As a result, a transcript from a non-owner participant can reach the downstream agent boundary marked as owner. Owner-sensitive behavior is then applied to the wrong speaker, enabling an authentication bypass in agent decision logic. The maintainers fixed the issue in version 2026.9.2.
Critical Impact
An unprivileged Discord voice participant can have utterances processed with owner privileges by the downstream agent, bypassing owner/non-owner authorization checks [CWE-362].
Affected Products
- OpenClaw (openclaw npm package) versions >= 2026.7.2
- OpenClaw (openclaw npm package) versions < 2026.9.2
- Discord agent-proxy voice sessions using the affected realtime control path
Discovery Timeline
- 2026-09-26 - CVE-2026-100546 published to the National Vulnerability Database (NVD)
- 2026-09-28 - Last updated in NVD database
- 2026-09-29 - EPSS score published
Technical Details for CVE-2026-100546
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in OpenClaw's Discord realtime voice transcript handler. OpenClaw processes streaming voice transcripts classified as control messages for agent decision-making. Each transcript carries speaker context identifying whether the originating participant holds owner status. Before dispatching a transcript downstream, OpenClaw performs an asynchronous control check against speaker context. Because the check and the dispatch are not atomic, a second concurrent transcript can mutate shared speaker context while the first is still in flight. The transcript then inherits owner status that belongs to a different participant.
For Discord agent-proxy sessions, this means an utterance originating from a non-owner can cross the agent boundary flagged as owner. The downstream agent applies owner-sensitive behavior to commands it should otherwise reject. Real-world impact scales with the tools and privileges granted to the affected agent.
Root Cause
The root cause is a non-atomic sequence between the asynchronous owner-status check and the transcript dispatch. Shared speaker context is read, then yielded on an await, then consumed by the dispatcher. A concurrent transcript handler running during the yield can overwrite the context the original handler is about to consume.
Attack Vector
Exploitation requires a Discord voice session where OpenClaw's realtime control path is enabled and an owner participant is also speaking. A non-owner participant generates voice utterances timed to coincide with owner utterances. The attacker does not need to compromise Discord authentication or OpenClaw itself. Successful exploitation depends on concurrent transcript timing and the command surface exposed to the agent. See the GitHub Security Advisory GHSA-5x6q-wg56-rxg8 and the VulnCheck Authentication Bypass Advisory for full technical context.
Detection Methods for CVE-2026-100546
Indicators of Compromise
- Agent action logs showing owner-only commands executed in response to utterances from non-owner Discord participants.
- Transcript records where the attributed speaker identifier does not match the Discord user ID that produced the originating audio frames.
- Clusters of concurrent transcripts arriving within sub-second windows on the same voice channel preceding an owner-privileged agent action.
Detection Strategies
- Inventory Node.js environments for the openclaw package at versions >= 2026.7.2 and < 2026.9.2 using software composition analysis.
- Correlate OpenClaw transcript dispatch logs with Discord voice session metadata to surface speaker-ID mismatches at the agent boundary.
- Alert on owner-gated agent commands triggered by participants whose Discord role lacks owner privileges.
Monitoring Recommendations
- Enable verbose logging on the OpenClaw realtime control path to capture speaker-context resolution for every transcript.
- Forward agent decision logs to a centralized data lake for cross-session correlation and retention.
- Review Discord audit logs alongside agent command history during any incident involving disputed owner actions.
How to Mitigate CVE-2026-100546
Immediate Actions Required
- Upgrade the openclaw package to version 2026.9.2 or later in all affected deployments.
- Audit recent agent command history for owner-privileged actions triggered through Discord voice sessions since 2026.7.2 was deployed.
- Restrict the tool and command surface available to Discord-connected agents until the patched version is in production.
Patch Information
The maintainers resolved the race condition in OpenClaw 2026.9.2. Update using npm install openclaw@2026.9.2 or pin the version in package.json and rebuild downstream agent images. Refer to the GitHub Security Advisory GHSA-5x6q-wg56-rxg8 for release notes.
Workarounds
- Disable Discord realtime voice for any OpenClaw agent that distinguishes owner and non-owner senders.
- Route Discord voice input through a text-only transcription path that re-validates speaker identity before invoking agent tools.
- Remove owner-gated commands from agents that cannot be updated or reconfigured in the short term.
# Configuration example
npm install openclaw@2026.9.2
npm ls openclaw
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.