OpenClaw Missing Owner Flag Validation in Discord Voice Transcript Handler

A vulnerability exists in OpenClaw versions prior to 2026.3.2, where the senderIsOwner flag is not properly validated when processing Discord voice transcripts through the agentCommand function. This oversight causes the flag to default to true, allowing non-owner voice participants to access owner-only tools such as gateway and cron functionalities in mixed-trust channels.

Impact

Exploitation of this vulnerability could lead to unauthorized access to owner-only tools within the Discord voice environment, particularly in channels where trust is mixed and participants are not all owners.

Remediation

Users are advised to update to OpenClaw version 2026.3.2 or later, and to ensure that the senderIsOwner flag is explicitly passed during Discord voice transcript processing. Additionally, implement regression tests to verify correct handling of owner and non-owner voice participants.