CVE-2026-41358: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41358 is an origin validation error in OpenClaw, an AI agent framework, that allows attackers to bypass Slack sender allowlist controls and inject unauthorized messages into the AI agent's model context. Affecting all OpenClaw npm package versions up to and including 2026.4.1, the vulnerability was reported by @AntAISecurityLab, first published on April 2, 2026, and disclosed publicly on April 23–24, 2026. It carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory, GitHub Advisory).

The root cause is CWE-346 (Origin Validation Error): OpenClaw's Slack integration fetched thread starter and thread-history context via the Slack API without filtering messages against the configured sender allowlist. The vulnerable code in prepare-thread-context.ts iterated over all thread history messages and included them in the agent context regardless of sender identity, meaning a non-allowlisted user could post a message in a thread where an allowlisted user later replied, and that non-allowlisted message would be passed to the AI model. The fix (commit ac5bc4f) introduced a per-message isSlackThreadContextSenderAllowed() check that validates each message's userId and botId against the effective allowlist before including it in context (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject arbitrary content into the AI agent's model context, potentially influencing the agent's responses, decisions, or actions in ways not intended by the deployment's access controls. The confidentiality impact is limited — an attacker may gain indirect access to information surfaced by the agent in response to manipulated context — while the integrity impact involves the ability to corrupt or manipulate the model's operational context. Availability is not affected, and there is no evidence of lateral movement potential beyond the scope of the AI agent's configured capabilities (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014–0.017% (4th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction — specifically, an allowlisted user must reply in the same Slack thread as the attacker's message — and the attack requires specific deployment conditions (sender allowlists must be configured) (GitHub Advisory, Feedly).

1. Identify target deployment: Confirm the target organization uses OpenClaw (npm) version ≤ 2026.4.1 with a Slack integration that has sender allowlists configured, restricting which users can interact with the AI agent.
2. Gain Slack workspace access: Obtain access to the Slack workspace as a non-allowlisted user (e.g., via a guest account, compromised account, or shared channel).
3. Post a malicious message: In a Slack channel or thread monitored by the OpenClaw agent, post a message containing adversarial content (e.g., prompt injection instructions intended to manipulate the AI agent's behavior or extract information).
4. Trigger allowlisted user reply: Wait for or socially engineer an allowlisted user to reply in the same thread. This causes OpenClaw to fetch the full thread history via the Slack API.
5. Context injection achieved: Because the vulnerable code does not filter thread history by sender allowlist, the attacker's non-allowlisted message is included in the agent's model context alongside the allowlisted reply, potentially influencing the agent's subsequent responses or actions (GitHub Advisory, Fix Commit).

• Logs: OpenClaw verbose logs (if enabled) will show slack: omitted non-allowlisted thread starter from context or slack: omitted N non-allowlisted thread message(s) from context after patching — absence of these messages on a patched system processing suspicious threads may indicate the patch was not applied. On unpatched systems, no such log entries exist, making detection harder.
• Slack Activity: Unusual or unexpected messages appearing in threads monitored by the OpenClaw agent from users not on the sender allowlist, particularly messages containing prompt-injection-style instructions or requests for sensitive information.
• Agent Behavior: Anomalous AI agent responses that appear to follow instructions not issued by allowlisted users, or responses that reference content not sent by authorized senders (Fix Commit, GitHub Advisory).

Upgrade the OpenClaw npm package to version 2026.4.2 or later, which filters both thread starter and thread history messages against the effective sender allowlist before including them in agent context. No configuration-based workaround is available for unpatched versions; the only remediation is upgrading. As an additional defense-in-depth measure, review Slack integration access controls and consider restricting which channels and threads the OpenClaw agent monitors (GitHub Advisory, Fix Commit).

The vulnerability was reported by @AntAISecurityLab and credited in the official advisory. The initial GitHub advisory (GHSA-7hrg-5w46-5r2x) was withdrawn on May 4, 2026, as a duplicate of the canonical advisory GHSA-qm77-8qjp-4vcm. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory, GitHub Advisory).