Executive brief
OpenClaw is a Slack integration library that processes system events like message changes and deletions. The vulnerability allows attackers to bypass authorization controls (Slack DM allowlists and per-channel user restrictions) by injecting unauthorized system events, potentially exposing conversations to unauthorized senders and enabling unauthorized message modifications.
Technical details
OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization (CWE-863) in Slack system event handlers for member and message subtypes (message_changed, message_deleted, thread_broadcast) in src/slack/monitor/events/members.ts and src/slack/monitor/events/messages.ts. The vulnerability allows unauthenticated system events to be enqueued after channel checks without verifying sender identity against configured allowlists. An authenticated Slack workspace user can send crafted system events from non-allowlisted senders to bypass DM policies and per-channel user restrictions. The fix routes event handlers through authorizeAndResolveSlackSystemEventContext() and fails closed when sender identity cannot be resolved. Patch available in version 2026.2.26.
Affected products
- OpenClaw openclaw <= 2026.2.25
Timeline
- 2026-02-26: disclosed: Original advisory GHSA-v8cg-4474-49v8 published
- 2026-03-21: other: Duplicate advisory GHSA-xgwg-m42c-8q62 published
- 2026-03-24: other: Duplicate advisory withdrawn