CVE-2026-100575 — OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access t…
Published: 2026-09-26 · CVSS: 8.7 · CVSS 4.0
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7