Listen to this Post
The vulnerability resides in OpenClaw’s Slack event handlers for system events like message_changed, message_deleted, and thread_broadcast, specifically within the files `src/slack/monitor/events/members.ts` and src/slack/monitor/events/messages.ts. These handlers improperly enqueued events after performing channel-based checks but failed to execute a shared, centralized sender authorization step. As a result, deployments relying on Slack Direct Message (DM) allowlists (configured via dmPolicy/allowFrom) or per-channel user allowlists were susceptible to receiving unauthorized system-event traffic. An attacker who is not on an allowlist could potentially trigger these system events, and the flawed logic would process them. The fix implements a new function, authorizeAndResolveSlackSystemEventContext(...), which routes all these event handlers through a consistent authorization gate. The system now “fails closed” by rejecting the event if the sender’s identity cannot be resolved or is not authorized, ensuring that all system events, especially those with specific subtypes, are properly vetted before any action is taken.
dailycve form:
Platform: OpenClaw (npm)
Version: <=2026.2.25
Vulnerability: Slack System Event Authorization
Severity: Moderate
date: 2026-02-25
Prediction: 2026-02-26
What Undercode Say:
Analytics:
Check installed OpenClaw version
npm list openclaw
Check current version programmatically
node -p "require('openclaw/package.json').version"
Inspect Slack DM policy configuration
cat ~/.openclaw/config/channels/slack.yaml | grep -i "dmpolicy|allowfrom"
Check for per-channel user allowlists
cat ~/.openclaw/config/channels/allowlists.yaml
Search logs for system events from unverified senders
find ~/.openclaw/logs -name ".log" | xargs grep -i "system event.enqueued without authorization"
Monitor audit logs specifically for message subtype events
tail -f ~/.openclaw/logs/audit.log | grep -E "message_changed|message_deleted|thread_broadcast"
Verify if the fix commit is present in local source
git log --oneline | grep "3d30ba1" || echo "Fix commit not found"
Compare installed version against vulnerable range
npm list openclaw --depth=0 | grep openclaw@ | awk -F@ '{print $2}' | while read v; do if [ "$v" \< "2026.2.26" ]; then echo "Vulnerable version ($v)"; else echo "Patched version ($v)"; fi; done
Exploit:
- Attacker identifies an OpenClaw instance with Slack integration using allowlists.
- Attacker, who is not on any target allowlist, sends a `message_changed` or `message_deleted` system event to a channel monitored by the bot.
- Vulnerable handler in `messages.ts` checks the channel but skips final sender verification.
- Event is enqueued and processed as if from an authorized source.
- Attacker triggers unauthorized actions by manipulating system message metadata.
Protection from this CVE:
- Update OpenClaw to version `2026.2.26` or later immediately.
- If immediate update is not possible, apply the fix commit manually:
`git cherry-pick 3d30ba18a2aba1e1b302e77ff33145c3b06c01c8`
- Temporarily disable processing of
message_changed,message_deleted, and `thread_broadcast` events in configuration. - Strengthen `dmPolicy` to `closed` or `restricted` where DM functionality is not strictly required.
- Audit all Slack tokens and rotate if any suspicious system event activity is detected.
- Monitor for unexpected `message` subtype events in system logs.
Impact:
Unauthorized users can inject spoofed system events (message edits, deletions, thread broadcasts) to bypass Slack DM and channel allowlists. This can lead to privilege escalation, data manipulation, and circumvention of access controls, potentially allowing attackers to execute actions restricted to trusted users and compromise workspace integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
