EUVD-2026-37153
GHSA-c8w7-9w9h-x69q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required prerequisite configuration (Slack integration active, reaction notifications disabled); PR:N because Slack workspace access - not system credentials - is the only requirement; I:L only for unauthorized agent input processing with no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.
AnalysisAI
OpenClaw before 2026.5.12 fails to enforce its own notification filter for Slack reaction events, allowing those events to bypass a disabled-notification setting and reach the agent processing pipeline (CWE-862: Missing Authorization). Any user with Slack workspace access can send reaction events to channels monitored by OpenClaw, triggering unintended agent execution with lower-trust input even when administrators have explicitly disabled reaction notifications. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be true for exploitation to succeed: (1) the OpenClaw Slack integration must be actively enabled in the deployment configuration, and (2) reaction notifications must be explicitly set to disabled - the bypass only manifests when this setting is in the disabled state because the enforcement logic that should block reactions is the missing component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) signals a network-reachable flaw requiring no privileges and no user interaction, but constrained by the AT:P (Attack Target Presence) condition - exploitation only succeeds when the Slack integration is active and reaction notifications are specifically configured as disabled. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with membership in a Slack workspace monitored by an OpenClaw deployment - where the Slack integration is active but reaction notifications have been administratively disabled - sends an emoji reaction to any message in a monitored channel. The missing authorization check fails to gate this event, and it is ingested by the agent pipeline as if it were a legitimate trigger. … |
| Remediation | Upgrade OpenClaw to version 2026.5.12 or later, which is the fix version identified in the CVE description and referenced in the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today