EUVD-2026-13970
GHSA-xgwg-m42c-8q62
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 5.4 reflects a moderate severity profile: the attack vector is network-accessible (AV:N) and requires only low privileges (PR:L) with low attack complexity (AC:L), but impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact (A:N). The CVSS assessment alone suggests this is a real but not critical issue. The risk is further contextualized by the CWE-863 classification, which indicates a known authorization weakness. Positively, a patch is confirmed available from the vendor, reducing exploit window. No KEV listing or public POC has been disclosed, suggesting low current exploitation likelihood. Under SSVC framework, this scores as 'manageable' risk: exploitation is possible but non-automatable (requires understanding event structure and allowlist configuration), technical impact is limited to partial confidentiality/integrity loss, and a patch exists. Organizations should prioritize this in their regular patching cycle but need not treat it as a critical emergency. |
| Exploit ScenarioDerived | An attacker with a low-privilege account in a Slack workspace integrated with vulnerable OpenClaw can craft a malicious message_changed system event that impersonates a sender from an allowlisted user or channel. By sending this event directly to OpenClaw's event handler (via API or event injection), the attacker bypasses the per-channel user allowlist that would normally prevent messages from their account, allowing them to trigger downstream automation or access restricted information. Since the attack vector is network-based with low complexity and only requires low privileges, an attacker with any Slack workspace access can attempt this with minimal barriers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 21, 2026
OpenClaw versions prior to 2026.2.26 contain an authentication bypass vulnerability in their Slack system event handlers that fails to properly enforce sender authorization checks. Attackers with low-privilege access (PR:L in CVSS vector) can craft and send unauthorized system events through message_changed, message_deleted, and thread_broadcast event types to bypass Slack DM allowlists and per-channel user allowlists. The vulnerability has a moderate CVSS score of 5.4 with low confidentiality and integrity impact; no KEV or active exploitation has been publicly disclosed, but a patch is available from the vendor.
RemediationAI
Upgrade OpenClaw to version 2026.2.26 or later as detailed in the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-v8cg-4474-49v8. The specific patch commit is available at https://github.com/openclaw/openclaw/commit/3d30ba18a2aba1e1b302e77ff33145c3b06c01c8 for verification. If immediate patching is not feasible, consider temporarily disabling OpenClaw's processing of message_changed, message_deleted, and thread_broadcast events, or restricting OpenClaw's Slack bot token permissions to read-only access until the upgrade can be applied. Additionally, review Slack allowlist configurations to ensure they are not the sole control layer for event authorization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a Slack integration platform (identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that processes Slack system events through member and message subtype handlers. The root cause is classified under CWE-863 (Incorrect Authorization), where the application fails to validate that incoming system events originate from authorized senders before enqueuing them for processing. The vulnerable code path accepts message_changed, message_deleted, and thread_broadcast events without performing sender identity verification, allowing attackers to spoof event sources and bypass downstream authorization checks that rely on per-channel or per-user allowlists. This represents a classic case of incomplete input validation in event-driven architectures where implicit trust assumptions about event provenance are not cryptographically validated.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued. Attackers can bypass Slack DM allowlists and per-channel user allowlists by sending system events from non-allowlisted senders through message_changed, message_deleted, and thread_broadcast events.
Blast Radius
ecosystem impact- 2 npm packages depend on openclaw (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.2.26.
Executive ViewAI
CVE-2026-32895 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OpenClaw Multiple Authorization and Command Execution
View all 20Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Exploit-DB