CVE-2026-32899

MEDIUM

OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers

Title source: cna

Description

OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.

References (4)

[Third Party Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j

[Patch] https://github.com/openclaw/openclaw/commit/aedf62ac7e669a89c7b299201bf6537dc6b12e0e

[Patch] https://github.com/openclaw/openclaw/commit/75dfb71e4e8b7c2feba5a8ca662f92ea840e0147

View Patch ZIP pw:eip

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-sender-policy-bypass-in-slack-reaction-and-pin-event-handlers

Scores

CVSS v3 4.3

EPSS 0.0004

EPSS Percentile 10.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-863

Status published

Products (4)

npm/openclaw 0 - 2026.2.25npm

OpenClaw/OpenClaw < 2026.2.25

openclaw/openclaw < 2026.2.25

OpenClaw/OpenClaw 2026.2.25

Published Mar 21, 2026

Tracked Since Mar 21, 2026