CVE-2026-32899: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32899 is an incorrect authorization vulnerability in OpenClaw (npm package) that allows authenticated network users to bypass configured sender policies for Slack reaction_* and pin_* non-message events. Affected versions are all releases prior to 2026.2.25 (confirmed latest affected: 2026.2.24). The vulnerability was published on March 21, 2026, with patches released on or around February 26, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): OpenClaw's Slack monitor processed reaction_* and pin_* event handlers without routing them through the shared authorizeSlackSystemEventSender function, which enforces DM dmPolicy/allowFrom checks and channel users allowlist enforcement. As a result, these non-message events were enqueued into system-event context regardless of whether the sender was permitted by configured policies. The fix (commits 75dfb71 and aedf62a) gates both Slack pin/reaction and Discord reaction ingress through the shared authorization path, adding regression test coverage for DM allow/deny and channel-user allowlist deny paths (GitHub Advisory, Patch Commit 1, Patch Commit 2).

Exploitation allows a low-privileged, network-accessible attacker to inject unauthorized reaction and pin events into the OpenClaw system-event context, bypassing configured DM policies and channel user allowlists. The primary impact is an integrity compromise: restricted senders can manipulate system event context and communication flows in ways that should be blocked by policy. There is no confidentiality or availability impact, and the scope is limited to the affected OpenClaw instance (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.026% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account capable of sending Slack events to the target OpenClaw deployment (Feedly).

1. Identify target: Locate an OpenClaw deployment (npm package version ≤ 2026.2.24) connected to a Slack workspace with restrictive DM policies or channel user allowlists configured.
2. Obtain low-privilege access: Acquire any Slack account that is present in the workspace but explicitly blocked by the target's dmPolicy, allowFrom, or channel users allowlist settings.
3. Send a restricted reaction or pin event: As the restricted sender, add a reaction (triggering a reaction_added event) or pin a message (triggering a pin_added event) in a DM or channel where the sender is not authorized.
4. Bypass policy check: Because affected versions do not route reaction_* and pin_* handlers through authorizeSlackSystemEventSender, the event is enqueued into the system-event context without authorization validation.
5. Inject unauthorized context: The injected event appears in OpenClaw's system-event context as if it came from an authorized sender, potentially influencing agent routing, session context, or downstream automation logic (GitHub Advisory, Patch Commit 1).

• Logs: OpenClaw verbose logs showing reaction_* or pin_* events enqueued from senders that should be blocked by dmPolicy or channel users allowlist; absence of slack: drop reaction sender or slack: drop pin sender log lines for known-restricted users (present only after patching).
• Application Behavior: Unexpected system-event context entries attributed to users not in the configured allowFrom list or channel users allowlist; agent sessions triggered by reaction or pin events from restricted senders.
• Audit: Review OpenClaw system-event logs for reaction_added, reaction_removed, pin_added, or pin_removed events where the user field corresponds to a Slack user ID that is not in the authorized sender list (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.2.25 or later, which routes all reaction_* and pin_* event handlers through the shared authorizeSlackSystemEventSender function. No configuration-based workaround is available for unpatched versions. After upgrading, audit system-event logs for suspicious reaction and pin events from unauthorized senders and verify that DM policies and channel allowlists are enforced as expected (GitHub Advisory, Patch Commit 1, Patch Commit 2).

The vulnerability was reported by researcher @tdjackey and credited in the official GitHub Security Advisory and changelog. The advisory was published by maintainer steipete on February 26, 2026. No significant broader media coverage or notable community commentary beyond the official advisory and standard CVE aggregator listings has been identified (GitHub Advisory).