CVE-2026-32895: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32895 is an incorrect authorization vulnerability in OpenClaw (npm package) that allows low-privileged network attackers to bypass Slack DM allowlists and per-channel user allowlists by sending unauthorized system events. Affected versions are all releases up to and including 2026.2.25; the patched version is 2026.2.26. The vulnerability was published on March 21, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-863 (Incorrect Authorization): the Slack system-event handlers in src/slack/monitor/events/members.ts and src/slack/monitor/events/messages.ts performed channel-level checks but did not enforce sender authorization before enqueueing system events (GitHub Advisory). Specifically, member_joined_channel, member_left_channel, message_changed, message_deleted, and thread_broadcast event handlers would enqueue system events after channel checks without invoking the shared authorizeAndResolveSlackSystemEventContext() function, meaning a non-allowlisted sender could inject events into the queue (GitHub Commit). The fix routes all affected handlers through authorizeAndResolveSlackSystemEventContext(...) and fails closed when message subtype sender identity cannot be resolved (GitHub Commit). Exploitation requires only low privileges (a valid Slack user account) and network access; no user interaction is needed.

Successful exploitation allows an attacker to bypass Slack DM allowlists (dmPolicy/allowFrom) and per-channel user allowlists, injecting unauthorized system events into the OpenClaw event queue. This results in limited confidentiality impact (unauthorized access to Slack communication context) and limited integrity impact (unauthorized message manipulation via message_changed, message_deleted, and thread_broadcast events), with no availability impact (GitHub Advisory). Deployments relying on allowlist-based access controls for Slack integrations are most at risk, as the bypass undermines the intended security boundary between authorized and unauthorized senders.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. Exploitation requires low privileges (a Slack account with access to the target workspace) and network access, making it accessible to any workspace member but limiting the attacker pool.

1. Reconnaissance: Identify an OpenClaw deployment (version ≤ 2026.2.25) integrated with a Slack workspace that uses DM allowlists (dmPolicy: allowlist) or per-channel user allowlists.
2. Obtain low-privileged access: Acquire a Slack user account in the target workspace that is not on the configured allowFrom or channel users allowlist.
3. Craft a system event: Send a Slack event of type message_changed, message_deleted, thread_broadcast, member_joined_channel, or member_left_channel from the non-allowlisted account targeting a monitored channel or DM.
4. Bypass authorization: Because the vulnerable handlers in members.ts and messages.ts do not invoke sender authorization checks before enqueueing, the event is accepted and enqueued as a system event despite the sender not being on the allowlist.
5. Achieve objective: The injected system event is processed by OpenClaw, allowing the attacker to manipulate message state (edits/deletions), inject member join/leave notifications, or access channel context that should have been restricted (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw system event logs showing message_changed, message_deleted, thread_broadcast, member_joined_channel, or member_left_channel events enqueued from Slack user IDs not present in the configured allowFrom or channel users allowlists.
• Application Behavior: Unexpected system events appearing in the OpenClaw event queue originating from non-allowlisted Slack senders, particularly in deployments with dmPolicy: allowlist or restrictive per-channel users configurations.
• Slack Audit Logs: Slack workspace audit logs showing message edit, deletion, or thread broadcast activity from users who should not have access to monitored channels or DMs.

Upgrade OpenClaw (npm) to version 2026.2.26 or later, which routes all affected event handlers through authorizeAndResolveSlackSystemEventContext() and fails closed when sender identity cannot be resolved (GitHub Advisory, GitHub Commit). As a temporary workaround prior to patching, restrict network access to OpenClaw systems, limit Slack workspace membership to trusted users, and monitor system event logs for unexpected ingress from non-allowlisted senders. Reviewing and tightening dmPolicy/allowFrom and per-channel users allowlist configurations can reduce exposure until the patch is applied.

The vulnerability was reported by researcher @tdjackey and credited in the official GitHub Security Advisory and the fix commit changelog (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the advisory and standard CVE tracking feeds has been identified.