CVE-2026-28392: OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands
(updated )
When Slack DMs are configured with dmPolicy=open, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions.
References
- github.com/advisories/GHSA-v773-r54f-q32w
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/f19eabee54c49e9a2e264b4965edf28a2f92e657
- github.com/openclaw/openclaw/releases/tag/v2026.2.14
- github.com/openclaw/openclaw/security/advisories/GHSA-v773-r54f-q32w
- nvd.nist.gov/vuln/detail/CVE-2026-28392
- www.vulncheck.com/advisories/openclaw-privilege-escalation-in-slack-slash-command-handler-via-direct-messages
Code Behaviors & Features
Detect and mitigate CVE-2026-28392 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →