Openclaw cli: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress (CVE-2026-32899)
Description
OpenClaw CLI versions up to 2026.2.24 have a low-severity vulnerability where Slack reaction and pin non-message events were processed without consistent sender-policy checks. This could allow events from senders outside the configured policy to be added to system-event context. The issue is fixed in version 2026.2.25 by enforcing sender authorization checks including DM policies and channel user allowlists.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw Slack monitor previously handled 'reaction_*' and 'pin_*' non-message events before consistently applying sender-policy checks, allowing these events to be added to system-event context even when sender policy would normally disallow them. The vulnerability affects npm package 'openclaw' versions from 2026.1.29 up to but not including 2026.2.25. The fix routes these event handlers through a shared sender authorization function that enforces DM policies and channel user allowlists before enqueuing system events. Regression tests were added to cover these authorization paths.
Potential Impact
The vulnerability may cause unexpected reaction or pin context signals from senders outside the configured sender policy to be processed. This is a low-severity issue with no confidentiality or availability impact, only limited integrity impact as per CVSS 4.3 (medium severity). No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available in OpenClaw version 2026.2.25 that enforces consistent sender-policy checks for Slack reaction and pin events. Users should upgrade to version 2026.2.25 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32899
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245b612601ec6a3166bbd
Added to database: 10/04/2026, 12:25:26 UTC
Last enriched: 10/04/2026, 13:00:41 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.