CVE-2026-100546

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.2 through 2026.9.1

Description A race condition exists in the Discord realtime voice transcript path. This occurs when concurrent control-classified voice transcripts consume speaker context from another participant following an asynchronous control check, leading a transcript to inherit the owner status of a different speaker. In Discord agent-proxy voice sessions, an utterance from a non-owner participant may be marked as owner when reaching the downstream agent boundary, resulting in owner-sensitive behavior being applied to the incorrect speaker. Exploitation is dependent on the timing of concurrent transcripts and the specific tools or commands available to the affected agent.

Recommendations Update to version 2026.9.2. Disable Discord realtime voice for agents that distinguish between owner and non-owner senders.