by Kastro
Paper/Archive/CVE-2026-28392

CVE-2026-28392

OpenClaw OpenClaw — OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.6.346 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.2.142026.2.14CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-v773-r54f-q32wpatchgithub.com/openclaw/openclaw/commit/f19eabee54c49e9a2e264b4965edf28a2f92e657writeupvulncheck.com/advisories/openclaw-privilege-escalation-in-slack-slash-command-handler-via-direct-messages