What is the CVSS score of CVE-2026-28392?

CVE-2026-28392 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-28392?

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability affecting organizations using Slack integration with direct message policies configured as 'open'.. A patch is available.

How to fix or mitigate CVE-2026-28392?

24 hours: Verify OpenClaw version and Slack dmPolicy configuration across all deployments; identify systems at risk. 7 days: Apply vendor patch to upgrade OpenClaw to version 2026.2.14 or later on all affected instances. 30 days: Conduct access review to identify any unauthorized privilege escalations that may have occurred; validate Slack integration permissions and restrict dmPolicy to 'closed' if business requirements allow.

Openclaw CVE-2026-28392

HIGH

Incorrect Authorization (CWE-863)

2026-03-05 disclosure@vulncheck.com

GHSA-v773-r54f-q32w

Privilege Escalation Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 10, 2026 - 20:10 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.

AnalysisAI

OpenClaw versions before 2026.2.14 allow unauthenticated attackers to execute privileged slash commands via direct message when the dmPolicy setting is configured to open, bypassing security controls like allowlists and access groups. This privilege escalation stems from improper authorization checks in the Slack slash-command handler that fails to validate direct message senders. A patch is available for affected users.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects the Slack slash-command component of Openclaw. OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.