OpenClaw versions earlier than 2026.2.14 are vulnerable because the Slack slash-command handler mistakenly allows any direct-message sender to execute privileged commands when dmPolicy is open. This flaw lets an attacker send a crafted message to a privileged Slack bot and bypass the slash-command allowlist and access-group restrictions, effectively granting the attacker the same level of control as the bot owner and compromising application integrity and potentially data confidentiality.

This vulnerability affects all installations of OpenClaw running any version prior to 2026.2.14, regardless of deployment environment. The issue resides in the core Slack integration component tied to the dmPolicy configuration, so any user who can send direct messages to the bot with dmPolicy set to open is exposed.

The CVSS score of 8.2 indicates high risk, but an EPSS score below 1% suggests a low likelihood of automated exploitation at present. The flaw is not listed in the CISA KEV catalog, implying no widespread active exploitation. Attackers would need access to a Slack workspace with a bot configured for OpenClaw and actively send direct messages to invoke privileged commands; the flaw is exploitable only within Slack and requires no remote code execution.