OpenClaw Slack CVE-2026-100531

Requires the @openclaw/slack plugin (before 2026.8.1) deployed with an authenticated caller whose access is restricted to a specific conversation, plus that caller knowing or obtaining a valid Slack file identifier for content in another conversation. Exploitation is triggered only for files that lack the share metadata normally used to prove conversation membership, which is what causes the authorization check to fail open. Limiting factors: the attacker must already be an admitted/authenticated OpenClaw user (PR:L), cannot list or enumerate arbitrary Slack files, and cannot bypass Slack's own authentication - impact is confined to disclosing individual file contents across configured conversation boundaries.

This is a moderate-severity, authenticated cross-boundary data-disclosure flaw (CWE-639, IDOR-class) rather than a high-urgency threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network reachable, low complexity, but requires an already-authenticated caller (PR:L) and yields confidentiality impact only - no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code identified, so all objective exploitation signals point to no active or imminent widespread exploitation. The 7.1 score is confidentiality-weighted and reasonable, though real-world risk is further constrained by two prerequisites the description names explicitly: the caller must already be an admitted OpenClaw user scoped to a conversation, and must know or obtain a valid file identifier. Note the input Tag 'Authentication Bypass' conflicts with both the CWE (CWE-639, authorization) and the description, which states the issue 'does not bypass Slack authentication itself' - treat this as an authorization (broken access control) flaw, not authentication bypass. Net: a genuine but bounded data-exposure issue in a niche OSS agent framework - patch when convenient, not a fire-drill.

An OpenClaw operator restricts a low-trust Slack user (or a steered agent acting on their behalf) to a single conversation. That caller supplies a Slack file identifier for a file in another conversation; because the file lacks the share metadata used to prove conversation membership, the authorization check fails open and the download handler returns the file contents, disclosing data across configured conversation boundaries. No public exploit code is identified, and exploitation requires an already-authenticated caller who has obtained a valid file ID.