rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.7 · EPSS 0.00261

CVE-2026-100575

OpenClaw Slack versions prior to 2026.8.1 do not enforce sender allowlists in multi-person direct messages, allowing unauthorized participan

Overview

OpenClaw Slack versions prior to 2026.8.1 do not enforce sender allowlists in multi-person direct messages, allowing unauthorized participants to trigger Slack agents. This flaw lets attackers access tools and data that should be protected by configured policies. The vulnerability is critical and can lead to significant data exposure.

Description

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.

Impact

Confidentiality is compromised as disallowed users can access sensitive data and tools. Integrity is at risk because attackers can manipulate agent actions. Availability is indirectly affected if agents are misused to overload resources. Administrators and end‑users of OpenClaw Slack are directly impacted.

Remediation

Apply the 2026.8.1 patch or later immediately. Verify that sender allowlists are correctly configured for all multi‑person DMs. Disable or restrict multi‑person DMs for untrusted participants until the patch is applied. Monitor Slack agent activity for anomalous triggers and review policy enforcement logs.

Risk context

The CVSS v3 score of 8.8 and critical severity indicate a high risk, but the EPSS of 0.00261 suggests a low probability of exploitation in the near term. Nonetheless, defenders should treat this as a priority update.

Affected products

  • OpenClaw Slack

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
8.7
EPSS
0.00261

Slack allowlist direct-messages critical OpenClaw agent-bypass confidentiality

← All CVEs

Related CVEs

critical

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

View analysis

critical

CVE-2026-100520

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

View analysis

critical

CVE-2026-100544

CVE-2026-100544 exposes the openclaw/voice-call package to remote callers who can trigger owner‑only tools without identity verification. The flaw allows attackers to read, modify, or execute commands on the agent. It is fixed in version 2026.8.1.

View analysis

critical

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.

View analysis