Executive brief
OpenClaw is a tool that integrates Slack conversations with AI agents. The vulnerability allows messages from users not on an approved sender list to be included in the AI agent's context when an approved user replies to a thread containing those messages. An attacker could inject unauthorized content into the agent's decision-making process, potentially leading to manipulation of the agent's behavior or exposure of sensitive information.
Technical details
OpenClaw before version 2026.4.2 fails to properly filter Slack thread context by the configured sender allowlist. The vulnerability exists in the thread-history fetching mechanism where messages from non-allowlisted senders can enter the agent context if an allowlisted user replies within the same thread. This is classified as an access-control bypass (CWE-346) specific to thread context filtering. The attack requires an allowlisted user to reply in a thread, which then includes non-allowlisted messages. The fix, present in version 2026.4.2 and later, filters thread context by the effective allowlist before passing it to the agent.
Affected products
- OpenClaw OpenClaw <= 2026.4.1
Timeline
- 2026-04-02: disclosed
- 2026-04-24: patched: Version 2026.4.2 released