CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-V773-R54F-Q32W

OpenClaw Open Door: Bypassing Slack Authorization via Direct Messages

Amit Schendel
Amit Schendel
Senior Security Researcher

Feb 18, 2026·6 min read·36 visits

Executive Summary (TL;DR)

If OpenClaw's Slack DM policy is set to 'open', any user can bypass allowlists and run privileged slash commands by DMing the bot. Fixed in version 2026.2.14.

A critical logic flaw in OpenClaw's Slack integration allowed unauthorized users to execute privileged slash commands simply by sending them via Direct Message. When the 'open' DM policy was enabled, the system conflated the ability to chat with the authority to command, effectively granting administrative privileges to any user in the Slack workspace.

The Hook: When "Open" Means "Wide Open"

AI agents are the new sysadmins. We give them keys to our AWS environments, access to our production databases, and the ability to deploy code. OpenClaw is one such autonomous agent, designed to live inside your chat apps like Slack and do your bidding. Naturally, you'd expect a digital entity with that much power to be picky about who it takes orders from.

OpenClaw implements an allowFrom list—a VIP club of users allowed to invoke slash commands. But it also has a configuration setting called channels.slack.dm.policy. If you set this to open, the intention is innocent enough: allow random users to chat with the bot, ask it questions, or get help.

However, in versions prior to 2026.2.14, the developers made a classic security blunder. They assumed that if a door is unlocked for visitors, it should also lead directly to the bank vault. This vulnerability is a story about how a single boolean flag turned a chatty bot into a confused deputy, willing to execute administrative commands for anyone who bothered to slide into its DMs.

The Flaw: Conflating Conversation with Command

The vulnerability lies in src/slack/monitor/slash.ts, specifically within the logic that handles incoming slash commands from Slack. Access control in chat bots usually follows a two-step verification: Authentication (who are you?) and Authorization (are you on the list?).

OpenClaw's logic for Direct Messages (DMs) short-circuited this process. When the bot received a command, it checked the context. If the message came from a public channel, it correctly checked the user against the allowFrom list. But if the message came from a DM, and the policy was set to open, the code explicitly set the authorization flag to true.

Here is the logic flaw in plain English: "If the user is allowed to DM me, they are allowed to control me." This ignores the reality that slash commands (like /openclaw-config or /restart) are fundamentally different from conversational inputs. The code failed to differentiate between permission to speak and permission to execute.

The Code: The Boolean Trap

Let's look at the "smoking gun" in the codebase. This snippet is from src/slack/monitor/slash.ts before the patch. Notice how commandAuthorized is handled inside the DM check.

// src/slack/monitor/slash.ts (Vulnerable)
 
// 1. Default to true (already a bad smell, secure by default!)
let commandAuthorized = true;
 
if (isDirectMessage) {
  // ... code to check policies ...
  if (ctx.dmPolicy === "open") {
    // 2. The Fatal Flaw
    // If DMs are open, we blindly authorize the COMMAND.
    commandAuthorized = true;
  }
}

Because of this block, the subsequent checks (which would normally filter out users not in the allowFrom group) were rendered moot. The variable commandAuthorized was hard-set to true based solely on the transport medium (Direct Message) rather than the user's identity.

The fix in version 2026.2.14 (Commit f19eabee54c49e9a2e264b4965edf28a2f92e657) inverts the default and forces a lookup:

// src/slack/monitor/slash.ts (Patched)
 
// 1. Default to false
let commandAuthorized = false;
 
// ... inside the DM check ...
// 2. Even if DM policy is open, we specificially check the authorizers
commandAuthorized = resolveCommandAuthorizedFromAuthorizers({
  useAccessGroups: ctx.useAccessGroups,
  authorizers: [{ configured: effectiveAllowFromLower.length > 0, allowed: ownerAllowed }],
  modeWhenAccessGroupsOff: "configured",
});

By forcing the code to call resolveCommandAuthorizedFromAuthorizers, the patch ensures that the allowFrom list is respected regardless of whether the command comes from a public channel or a private DM.

The Exploit: Sliding into DMs for Root

Exploiting this vulnerability does not require complex memory corruption or packet manipulation. It requires a Slack account in the target workspace and the audacity to talk to the bot privately.

The Attack Scenario:

  1. Reconnaissance: The attacker (perhaps a contractor or an intern with low-level Slack access) notices the OpenClaw bot in the workspace.
  2. Testing the Waters: The attacker attempts to run a privileged command like /openclaw-config dump in a public channel (#general). The bot correctly responds: "You are not authorized to perform this action."
  3. The Bypass: The attacker opens a Direct Message with the OpenClaw bot.
  4. Execution: The attacker sends the same slash command /openclaw-config dump in the DM.
  5. Success: Because channels.slack.dm.policy is set to open (a common config for friendly bots), the vulnerable code sees the DM context, skips the ACL check, and dumps the configuration—potentially revealing API keys, environment variables, or other sensitive data.

> [!NOTE] > This attack vector is particularly dangerous because slash commands are often used for administrative tasks: restarting services, changing configurations, or triggering deployments.

The Impact: Why This Matters

The CVSS score of 4.4 (Moderate) is deceptively low here. It relies on the metric Attack Complexity: High because the victim must explicitly configure dmPolicy: open. However, enabling DMs is a standard feature for conversational agents. If an administrator turns that feature on, they inadvertently dismantle their entire authorization model.

If OpenClaw is connected to critical infrastructure (e.g., it can trigger CI/CD pipelines or access cloud provider APIs), this vulnerability is effectively a Privilege Escalation exploit. An unprivileged user in the Slack workspace can perform actions as the bot. If the bot has 'God Mode' permissions, now the intern does too.

Furthermore, because the attack happens in a Direct Message, it is quieter than a public channel exploit. There are no witnesses in #general to see the intern executing admin commands, making detection harder without rigorous audit logs.

The Fix: Shutting the Back Door

Remediation is straightforward: update the openclaw package immediately.

Remediation Steps:

  1. Upgrade: Update your deployment to openclaw version 2026.2.14 or later.
  2. Audit: Check your config.yaml or environment variables. If you use channels.slack.dm.policy: "open", assume that prior to the patch, any user could have executed commands.
  3. Review Logs: If you have audit logs for command execution, look for privileged slash commands originating from users who should not have access, specifically within DMs.

If you cannot patch immediately, the workaround is to change the configuration:

channels:
  slack:
    dm:
      policy: "restricted" # or "disabled"

This will prevent the vulnerable code path from being triggered, though it also disables the ability for general users to chat with the bot in DMs.

Official Patches

OpenClawOfficial Release v2026.2.14

Fix Analysis (1)

Technical Appendix

CVSS Score
4.4/ 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Systems

OpenClaw (npm package)

Affected Versions Detail

Product
Affected Versions
Fixed Version
openclaw
OpenClaw
<= 2026.2.132026.2.14
AttributeDetail
Attack VectorNetwork (Slack API)
CVSS4.4 (Moderate)
Privileges RequiredNone (Any Slack User)
ImpactPrivilege Escalation
Exploit StatusPoC Available
ComponentSlack Slash Command Handler

MITRE ATT&CK Mapping

T1078Valid Accounts
Initial Access
T1068Exploitation for Privilege Escalation
Privilege Escalation
CWE-862
Missing Authorization

Known Exploits & Detection

GitHubReproduction test case included in fix commit (src/slack/monitor/slash.policy.test.ts)

Vulnerability Timeline

Vulnerability Patched in Commit f19eabee
2026-02-14
Release v2026.2.14 Published
2026-02-14
GHSA Advisory Published
2026-02-18

References & Sources

  • [1]GitHub Advisory
  • [2]OSV Entry

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•2 days ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
7 views•5 min read
•2 days ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
9 views•7 min read
•2 days ago•GHSA-P6PH-3JX2-3337
4.3

GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

Amit Schendel
Amit Schendel
8 views•5 min read
•2 days ago•GHSA-86CX-WWF4-PHQ4
6.5

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

Amit Schendel
Amit Schendel
7 views•6 min read
•2 days ago•CVE-2026-16584
7.0

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.

Amit Schendel
Amit Schendel
12 views•7 min read
•3 days ago•GHSA-6V4M-FW66-8R4X
6.5

GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.

Alon Barad
Alon Barad
6 views•7 min read