All vulnerabilities
CVE-2026-100575GHSA-58qx-6m8p-wh2j

OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM

openclaw slack
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.8.1Fixed versionCVE List
Published26 Sep 2026Updated 8 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.

Text from CVE List

Affected versions 2

  • slackaffected: all versions before 2026.8.1CVE List
  • slackunaffected: 2026.8.1CVE List

References 2