Executive brief
OpenClaw, a gateway tool, contains a flaw where Mattermost slash command tokens remain valid for a short period after they have been revoked. This could allow an unauthorized user with an old token to continue executing commands until the system's monitor refreshes. Depending on the configuration, this may lead to unauthorized actions or data manipulation within the connected Mattermost environment.
Technical details
A vulnerability in OpenClaw (classified as CWE-613: Insufficient Session Expiration) causes a delay in the revocation of Mattermost slash tokens. The root cause is that the system continues to accept old tokens during a refresh window until the Mattermost monitor is explicitly refreshed or restarted. An attacker possessing a revoked token can exploit this network-reachable path to invoke slash command behaviors briefly after rotation. The issue is addressed in version 2026.4.24; users on older versions should manually restart the monitor after rotating tokens.
Affected products
- openclaw openclaw <= 2026.4.23
Timeline
- 2026-05-28: disclosed
- 2026-07-02: advisory
- patched: Version 2026.4.24 released