GHSA-x2ff-j5c2-ggpr: OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
- Identifier
- GHSA-x2ff-j5c2-ggpr
- Published
- Record updated
- Affected
- openclaw <= 2026.2.24
- Fixed in
- 2026.2.25
- released February 25, 2026, 6 days before disclosure
Summary
OpenClaw versions `<= 2026.2.24` accepted some Slack interactive callbacks (`block_action`, `view_submission`, `view_closed`) before full sender authorization checks in shared workspace deployments that use sender restrictions. An unauthorized workspace member could enqueue system-event text into an active session, but the issue did not by itself provide unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation.
Mitigation
Fixed in `2026.2.25` (planned next npm release), via commit `ce8c67c314b93f570f53c2a9abc124e1e3a54715`. The source states that OpenClaw does not support adversarial multi-user isolation on a single shared gateway instance; the supported model is one trust boundary per gateway, with separate gateways or hosts for mutually untrusted users.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online