Executive brief
OpenClaw is a platform integration tool that connects Slack to backend services via slash commands. When Slack DMs are configured to allow open messaging (dmPolicy=open), the bot incorrectly treated all DM senders as authorized users, allowing any workspace member who could DM the bot to execute privileged slash commands that should have been restricted to allowlisted users or groups. This could enable unauthorized access to sensitive bot functions and backend operations.
Technical details
The vulnerability is an authorization bypass (CWE-285, CWE-863) in OpenClaw's Slack slash-command handler. When dmPolicy=open is configured, the handler fails to apply the standard allowlist/access-group authorization checks to commands received via DM, instead treating all DM senders as pre-authorized. This is a missing authorization check in the DM command path compared to other inbound message paths. An attacker requires only the ability to send DMs to the bot within the Slack workspace—no authentication bypass is needed. The impact allows execution of privileged slash commands that should be restricted by role or group membership. The fix, released in version 2026.2.14, ensures DM commands use the same CommandAuthorized gating logic applied to other inbound paths.
Affected products
- OpenClaw openclaw <= 2026.2.13
Timeline
- 2026-02-18: disclosed
- 2026-02-14: patched: Fix commit f19eabee54c49e9a2e264b4965edf28a2f92e657
- 2026-03-05: advisory: NVD published