CVE-2026-100575 in Slack
Summary
by MITRE • 09/26/2026
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw Slack prior to version 2026.8.1 represents a critical failure in identity verification and authorization logic within multi-person direct message channels. This flaw stems from an improper enforcement of sender allowlists, which are security controls designed to restrict interaction with AI agents or automated systems to only pre-approved users. In the context of Slack integrations, such allowlists serve as the primary boundary between authorized operational access and unauthorized intrusion, ensuring that sensitive tools and data remain accessible solely to trusted entities. The architecture likely relies on checking the sender identity against a whitelist before processing commands or triggering agent behaviors, but this check is bypassed in group direct message scenarios due to flawed logic handling multiple participants.
Technically, the flaw allows disallowed participants to trigger Slack agents despite being explicitly excluded by configured policies. This indicates that the application fails to validate the origin of each individual message within a multi-party conversation context or incorrectly aggregates sender identities when determining permission levels. Instead of requiring all active participants in a direct message channel to be whitelisted, or correctly isolating messages from non-whitelisted users, the system processes commands regardless of who initiated them if any participant is authorized. This logical error effectively neutralizes the intended access control mechanism, allowing an attacker with minimal privileges within a Slack workspace to execute actions that should be restricted to high-trust individuals.
The operational impact of this vulnerability is severe, as it grants unauthorized users direct access to tools and data granted to those agents. These agents often possess elevated permissions to interact with external APIs, query databases, or manipulate internal systems on behalf of the organization. By bypassing sender policies, an attacker can leverage these capabilities for malicious purposes such as exfiltrating sensitive corporate information, executing arbitrary code within connected environments, or disrupting business operations through unauthorized automated actions. This constitutes a significant breach of confidentiality and integrity, potentially leading to data leakage and compromise of downstream systems that trust the Slack agent's authority.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in authorization logic where access rights are not correctly enforced based on user identity or group membership. It also maps to MITRE ATT&CK techniques related to Initial Access and Privilege Escalation, as the attacker exploits a misconfiguration to gain unauthorized foothold within an automated workflow ecosystem. The attack vector is primarily local to the Slack workspace but can be leveraged for broader network intrusion depending on the scope of permissions granted to the compromised agent.
Mitigation requires immediate upgrading to OpenClaw Slack version 2026.8.1 or later, where this logic error has been corrected. In addition to patching, organizations should review their slack integration configurations to ensure that sender allowlists are strictly enforced across all channel types, including multi-person direct messages. Implementing additional layers of authentication for sensitive operations and auditing agent permissions can further reduce the blast radius if similar vulnerabilities exist in other components. Regular security assessments focusing on access control logic in chat-based automation tools are recommended to prevent recurrence of such authorization bypasses.