CVE-2026-100546 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a transcript to inherit another speaker's owner status. In Discord agent-proxy voice sessions using the affected realtime control path, an utterance from a non-owner participant could reach the downstream agent boundary marked as owner, so owner-sensitive behavior is applied to the wrong speaker. Exploitation depends on concurrent transcript timing and on the tools and commands available to the affected agent. The issue is fixed in 2026.9.2; as a workaround, disable Discord realtime voice for agents that distinguish owner and non-owner senders.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within OpenClaw versions ranging from 2026.7.2 up to but not including 2026.9.2 represents a critical race condition situated in the real-time voice transcript processing pipeline, specifically affecting Discord agent-proxy sessions. This flaw arises during the handling of concurrent control-classified voice transcripts where asynchronous operations fail to maintain strict atomicity regarding speaker context assignment. When multiple participants are active simultaneously, the system performs an asynchronous check to determine user roles and permissions before finalizing the transcription metadata. Due to timing discrepancies inherent in this non-atomic sequence, a transcript segment belonging to one participant can inadvertently inherit the contextual ownership attributes of another participant who was processed concurrently but completed their context assignment earlier or later depending on thread scheduling. This results in a state where an utterance from a non-owner participant is incorrectly tagged as originating from an owner within the downstream agent boundary.
From a technical perspective, this issue exemplifies a classic Time-of-Check to Time-of-Use (TOCTOU) race condition, which aligns with CWE-367 in the Common Weakness Enumeration taxonomy. The core failure lies in the separation of the permission verification step and the actual application of those permissions within the voice processing stream. In Discord agent-proxy environments, the architecture relies on distinguishing between owner-level commands that grant elevated privileges and standard user inputs for security isolation. When the race condition triggers, the downstream AI agent receives input marked with owner status despite it originating from a regular participant. This misattribution bypasses intended access controls because the agent processes the command based on its perceived source identity rather than verifying the actual network-level authentication state at the moment of execution.
The operational impact of this vulnerability is significant for any deployment that utilizes role-based access control within voice-enabled AI agents. An attacker capable of generating concurrent voice streams can exploit this timing window to execute privileged commands or trigger owner-sensitive behaviors without proper authorization. This could lead to unauthorized data exfiltration, manipulation of agent state, execution of arbitrary code if the agent has tool integration capabilities, or denial of service through disruptive command injection. The severity is further amplified by the fact that exploitation depends on precise concurrent timing and the specific configuration of available tools, meaning that environments with highly privileged agent configurations are at greater risk. Successful exploitation allows a non-privileged user to effectively escalate their privileges within the application logic, compromising the integrity and confidentiality guarantees provided by the access control model.
To mitigate this vulnerability, organizations must immediately upgrade OpenClaw to version 2026.9.2 or later where the race condition has been resolved through improved synchronization mechanisms in the transcript handling code. For environments that cannot update immediately due to dependency constraints, a recommended workaround is to disable Discord real-time voice functionality for any agents that distinguish between owner and non-owner senders. This effectively removes the attack surface by preventing the processing of concurrent voice transcripts where role ambiguity can occur. Additionally, implementing strict serialization for speaker context assignment or validating ownership at every individual command execution point rather than relying on session-level context tags would provide defense in depth against similar race conditions. Security teams should also audit agent configurations to ensure that no critical operations are performed based solely on inferred user roles from voice transcripts without secondary authentication verification.