Executive brief
OpenClaw is an AI agent platform that integrates with Slack to provide automated responses and assistance. A vulnerability allows messages from users not on the approved sender allowlist to be included in the AI agent's context when they appear in Slack threads alongside allowlisted users. This bypasses access controls designed to prevent certain users from influencing the agent's decisions, potentially allowing restricted users to inject content the agent will process.
Technical details
The vulnerability is an access control bypass (CWE-346) in Slack thread context processing. OpenClaw's API fetches Slack thread starter and thread history but fails to filter these messages against the effective sender allowlist before feeding them into the agent's model context. An attacker can post messages in a thread where an allowlisted user also participates; those messages will be included in the agent's context despite the sender being on the denylist. The fix, released in version 2026.4.2, applies allowlist filtering to all Slack thread context data. No authentication bypass is required—the vulnerability exists within the application's access control logic itself.
Affected products
- OpenClaw OpenClaw <= 2026.4.1
Timeline
- 2026-05-04: disclosed
- 2026-05-04: patched: Fix released in version 2026.4.2