CVE-2026-113799: CWE-532: Insertion of Sensitive Information into Log File in abdolence slack-morphism-rust

Slack Morphism is a client library for Slack APIs. In versions 1.0.0 through 2.27.0, when an invalid Slack request is received, the library computes the correct HMAC signature for the attacker-controlled timestamp and request body and stores it in an error object. The error's debug and display outputs expose this computed signature, which the default Axum listener error handler logs at error level. An attacker able to send requests to the Slack callback endpoint and read the application logs can use this behavior as a chosen-message HMAC oracle to recover valid signatures. The attacker can then resend the same request within Slack's five-minute freshness window, bypassing signature verification and reaching protected callbacks without knowing the signing secret. The vulnerability is patched in version 2.28.0.

An attacker with the ability to send requests to the Slack callback endpoint and read application logs can recover valid HMAC signatures for arbitrary requests. This enables bypassing Slack Morphism's signature verification, potentially allowing unauthorized requests to reach protected application callbacks. The vulnerability impacts the integrity of request validation but does not affect confidentiality or availability directly.

Upgrade Slack Morphism to version 2.28.0 or later, where this vulnerability is patched. Until then, restrict access to application logs and the Slack callback endpoint to trusted parties only to reduce the risk of exploitation.