OpenClaw Slack CVE-2026-100575

Exploitation requires: (1) an OpenClaw Slack agent deployed with a configured sender allowlist policy (the feature being bypassed); (2) the attacker to be a participant in a multi-person / group direct message that includes that agent - so the attacker must be an authenticated Slack workspace user who was intentionally excluded from the allowlist; and (3) the affected version being before 2026.8.1. The concrete flaw is that allowlist enforcement is skipped specifically in multi-person DMs, not 1:1 DMs. Impact is limited by the scope of tools and data granted to the targeted agent - a read-only agent yields only data disclosure, whereas an agent with command/write tools yields far greater impact. No end-user interaction on the victim side is required.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates this 8.7 (High), and this is broadly defensible for the exploit mechanics: the attack is network-reachable through Slack, low-complexity, and requires only low privilege (PR:L) - the attacker must be a participant in a multi-person direct message, i.e. an authenticated Slack user who was NOT on the agent's sender allowlist. No user interaction is needed (UI:N). The realistic technical impact, however, is bounded by whatever tools and data the targeted Slack agent has been granted; the vendor's VC:H/VI:H/VA:H assumes a highly-privileged agent (e.g. one with command or write tools), which will not hold for every deployment, so I assess impact slightly lower and availability as limited (see my vector). This is CWE-862 missing authorization (an authorization/allowlist bypass), not true authentication bypass despite the input tag. On real-world priority: EPSS is not provided, there is NO CISA KEV listing and NO public POC identified in the input, so there is no evidence of active or automated exploitation - this is a real but not urgent issue. The dominant risk-limiting factor is product prevalence: OpenClaw is a niche open-source agent framework, so despite the high CVSS this is a targeted, low-widespread-exposure concern rather than a mass-exploitation priority. Key missing data: EPSS score and any independent exploitation telemetry.

An attacker who holds a valid Slack account but is deliberately excluded by the agent's configured sender allowlist gets added to (or participates in) a multi-person/group direct message that includes an OpenClaw Slack agent. Because the allowlist is not enforced for group DMs, the attacker sends a message that the agent processes, invoking whatever tools and reading whatever data that agent is authorized to use. No public exploit code is identified at time of analysis; exploitation requires only a Slack message, no user interaction on the victim side.