EUVD-2026-25342
GHSA-7hrg-5w46-5r2x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-trivial precondition that an allowlisted user must reply to the attacker's thread; PR:N because the attacker needs only standard Slack access; UI:R for the required allowlisted-user reply; limited context manipulation yields C:L/I:L with no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.2.
DescriptionCVE.org
OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context. Attackers can inject unauthorized thread messages through allowlisted user replies to bypass sender access controls and manipulate model context.
AnalysisAI
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
Technical ContextAI
OpenClaw is an npm-packaged AI agent framework (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that integrates with Slack via the Bolt SDK. When processing an inbound Slack event in a monitored thread, the resolveSlackThreadStarter and prepareThreadContext functions call the Slack conversations.replies API to assemble thread-starter and thread-history content before constructing the prompt passed to the language model. Prior to 2026.4.2, these functions did not apply the effective conversation sender allowlist when filtering the returned messages, meaning message origin (sender identity) was never validated for thread-sourced content - only for the triggering message itself. This is a textbook CWE-346 (Origin Validation Error): the code trusted the Slack API response as implicitly authorized rather than re-validating each message's sender against the access-control allowlist. The fix in commit ac5bc4fb extends thread-message structs to carry bot_id alongside user fields and applies allowlist filtering across all thread messages before they reach agent context, as confirmed by the added test suite in prepare-thread-context.test.ts.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.2 or later, which includes the sender-allowlist filtering fix from commit ac5bc4fb37becc64a2ec314864cca1565e921f2d. Full vendor advisory and patch details are at https://github.com/openclaw/openclaw/security/advisories/GHSA-qm77-8qjp-4vcm and the VulnCheck write-up at https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-slack-thread-context. Before upgrading, verify that version 2026.4.2 is live on the npm registry, as the GHSA advisory indicated it had not yet been published at advisory release time. If immediate upgrade is not feasible, a compensating control is to disable thread-context fetching in the OpenClaw Slack configuration, which eliminates the injection surface but degrades agent response quality for threaded conversations by removing historical context. A second option is restricting monitored Slack channels to those where only allowlisted users have posting rights, which reduces attacker opportunity without requiring a configuration change to OpenClaw itself, though it does not patch the underlying code path.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today