CVE-2026-28392: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28392 is a privilege escalation vulnerability in OpenClaw's Slack slash-command handler affecting all versions prior to 2026.2.14 (npm package). When the dmPolicy is explicitly configured to open, the handler incorrectly treated any Slack direct message (DM) sender as command-authorized, allowing any workspace user to execute privileged slash commands via DM and bypass allowlist and access-group restrictions. The vulnerability was published on March 5, 2026, with a patch released in version 2026.2.14. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): the slash-command handler in src/slack/monitor/slash.ts initialized the commandAuthorized variable to true for DM paths when dmPolicy=open, rather than computing authorization through the same allowlist/access-group gating logic applied to other inbound paths. The fix (commit f19eabe) changes the default to false and explicitly calls resolveCommandAuthorizedFromAuthorizers() for DM slash commands, aligning DM authorization with the message-handler path. Exploitation requires only that the attacker be a member of the Slack workspace and that the target OpenClaw deployment has channels.slack.dm.policy: open configured — no credentials or prior access to the bot's allowlist are needed (GitHub Advisory, GitHub Commit).

Any Slack workspace member who can send a direct message to the OpenClaw bot can invoke privileged slash commands that would normally be restricted to allowlisted users or specific access groups. This can lead to unauthorized administrative actions, potential data access or exfiltration, integrity compromise of bot-managed workflows, and disruption of availability depending on the commands exposed. The impact is bounded to deployments with dmPolicy=open explicitly set, but within those deployments the full privileged command surface is exposed to all workspace users (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify a target organization using OpenClaw with Slack integration. Confirm the bot is present in the Slack workspace and that dmPolicy=open is configured (observable if the bot responds to unsolicited DMs).
2. Initiate DM: As any Slack workspace member, open a direct message conversation with the OpenClaw bot.
3. Send privileged slash command: Issue a privileged slash command (e.g., /openclaw <admin-command>) directly in the DM channel. Because commandAuthorized was incorrectly initialized to true for DM paths in versions ≤ 2026.2.13, the handler skips allowlist/access-group checks.
4. Achieve unauthorized execution: The bot executes the privileged command as if the sender were an authorized user, potentially granting administrative access, triggering sensitive operations, or exposing restricted data (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw application logs showing privileged slash commands executed from DM channels (channel_name: directmessage) by users not present in the configured allowlist or access groups.
• Logs: Slack audit logs recording slash command invocations from unexpected user IDs (user_id) in direct message channels with the bot.
• Behavioral: Privileged bot actions (e.g., administrative operations, data exports, configuration changes) triggered outside of expected channels or by non-admin users.
• Configuration: Presence of channels.slack.dm.policy: open in the OpenClaw configuration file on affected versions (≤ 2026.2.13) (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.14 or later, which correctly gates DM slash command authorization through the same allowlist/access-group logic as other inbound paths (GitHub Commit). For organizations unable to patch immediately, change channels.slack.dm.policy from open to a more restrictive setting (e.g., disabled or an allowlist-based policy) to eliminate the vulnerable code path. After patching, audit Slack slash-command logs for unauthorized privileged command executions and review access-group membership for any unauthorized administrative access that may have occurred (GitHub Advisory, Feedly).

The vulnerability was reported by researcher christos-eth and acknowledged by the OpenClaw maintainer (steipete) in the GitHub Security Advisory. Community discussion was observed on Mastodon (infosec.exchange) and aggregated by security feeds including RedPacket Security and The Hacker Wire. No major vendor statements or significant media coverage beyond standard CVE aggregation sites have been identified (GitHub Advisory).