OpenClaw CVE-2026-53823

Attacker must (1) hold a valid account in the same Slack workspace where the vulnerable OpenClaw instance is deployed (PR:L), (2) have permission to edit their Slack display name - the default in most workspaces unless restricted by an admin policy, and (3) know or guess an existing allowFrom policy entry value to impersonate. Exploitation is limited to OpenClaw deployments that use the allowFrom feature with display-name-based policy entries; deployments that use immutable Slack user IDs in allowFrom, or that do not use allowFrom at all, are not affected. No user interaction from the victim is required (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) yields 8.6 and aligns with the described attack: network-reachable, low-complexity, requires some privilege (a Slack account in the workspace), no user interaction, with high confidentiality and integrity impact on the agent identity being impersonated. Real-world risk hinges on a key precondition not captured by CVSS alone: the attacker must already possess a valid Slack account in a workspace where OpenClaw is deployed and must know an allowFrom policy entry to mimic - this limits opportunistic exploitation but is trivially satisfied by any malicious insider or compromised Slack account. No EPSS, KEV, or SSVC data was provided; with no public exploit identified at time of analysis and no KEV listing, this is a high-severity logic flaw rather than a mass-exploitation candidate, but insider-threat and post-Slack-compromise scenarios make patching a near-term priority for any OpenClaw operator.

An attacker with any Slack account in a workspace where OpenClaw is deployed enumerates or guesses an allowFrom policy entry (e.g., the display name of a privileged operator), edits their own Slack profile to set that display name, then issues a normal agent request through Slack; OpenClaw matches the spoofed display name against the policy and grants access intended for the legitimate operator. No public exploit identified at time of analysis, but the attack requires only standard Slack profile-edit functionality and no specialized tooling.