CVE-2026-28392 | THREATINT

Description

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.

PUBLISHED Reserved 2026-02-27 | Published 2026-03-05 | Updated 2026-03-06 | Assigner VulnCheck

HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Problem types

Incorrect Authorization

Product status

Default status

unaffected

Any version before 2026.2.14

affected

Credits

Christos (@christos-eth) reporter

References

github.com/...enclaw/security/advisories/GHSA-v773-r54f-q32w (GitHub Security Advisory (GHSA-v773-r54f-q32w)) vendor-advisory

github.com/...ommit/f19eabee54c49e9a2e264b4965edf28a2f92e657 (Patch Commit) patch

www.vulncheck.com/...ash-command-handler-via-direct-messages (VulnCheck Advisory: OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages) third-party-advisory

cve.org (CVE-2026-28392)

nvd.nist.gov (CVE-2026-28392)

Download JSON