OpenClaw Slack versions before 2026.8.1 contain a flaw that allows a user who is not on an allowed list to send messages in a multi-person direct message. Such disallowed participants can trigger Slack agents, causing those agents to execute in the context of the authorized account and gain access to the tools and data that the account owns. This results in an improper authorization weakness that can lead to unauthorized use of internal resources.

The vulnerability affects the OpenClaw Slack product prior to version 2026.8.1. Any deployment of OpenClaw Slack that has not been upgraded to 2026.8.1 or later is susceptible.

The CVSS score of 8.7 reflects a high severity for improper authorization. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is a malicious or compromised user participating in a group direct message; such a user can abuse the allowlist bypass to invoke agents and access privileged resources. The combination of high severity and the ability for attacker groups to join the conversation suggests a non-negligible risk for environments with broad group DM access.