CVE-2026-28392
HIGH
GHSA-v773-r54f-q32w
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3Description
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.
Analysis
OpenClaw versions before 2026.2.14 allow unauthenticated attackers to execute privileged slash commands via direct message when the dmPolicy setting is configured to open, bypassing security controls like allowlists and access groups. This privilege escalation stems from improper authorization checks in the Slack slash-command handler that fails to validate direct message senders. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
24 hours: Verify OpenClaw version and Slack dmPolicy configuration across all deployments; identify systems at risk. 7 days: Apply vendor patch to upgrade OpenClaw to version 2026.2.14 or later on all affected instances. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today