CVE-2026-53849: OpenClaw: Discord allowFrom could bind to mutable display names

allowFrom is the policy list that decides which Discord identities may talk to an OpenClaw agent. In affected versions, an entry could bind to display or global name metadata. Anyone can change those on their own account at will, so they prove nothing about who the sender is. An attacker with a Discord account sets a display name equal to a listed entry and is treated as that person.

The attacker needs a Discord account that can reach the bot, and an allowlist that uses name-style entries. No victim interaction is needed, and the attack is network-reachable at low privilege. What they gain is the agent access intended for the impersonated identity. That can be a tool-enabled agent with shell, file or MCP access, so the real impact depends on which tools that identity could use and on how much the Gateway exposes. The advisory notes it does not change the trusted-operator model, and that practical impact depends on configuration. The weakness class is authentication bypass by spoofing (CWE-290).

The npm package openclaw up to and including 2026.5.6, when the Discord channel is enabled and allowFrom policy entries match on display names. Deployments that already list stable Discord user IDs are not affected by the matching bug. Check:

npm ls -g openclaw

Then review your Discord allowFrom entries for names rather than numeric IDs.

Upgrade to openclaw 2026.5.7, the first stable patched version.

npm install -g [email protected]

Until patched, the advisory says to use stable Discord user IDs in allowlists. Its general hardening advice is narrow channel and tool allowlists, no sharing of one Gateway between mutually untrusted users, and disabling features you don't need. After upgrading, replace any display-name entries with numeric user IDs.

Review Discord allowFrom entries and look for names where IDs belong. Check agent session logs for messages from Discord accounts whose numeric ID is not one you recognise but whose display name equals a listed entry. Look at what tools those sessions ran. Beam records the shell commands, file access and MCP tool calls an agent makes, and its rules flag risky ones, so a session driven by a spoofed sender can be reviewed there.

Summary

Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to change display or global name metadata could match a policy entry through mutable display metadata.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could receive agent access intended for another Discord identity. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.7.

Mitigations

use stable Discord user IDs in allowlists until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.