OpenClaw releases before 2026.2.26 omit sender authorization checks inside their member and message subtype system event handlers. This flaw allows an attacker to submit system events—such as message_changed, message_deleted, and thread_broadcast—using senders that are not on the platform’s allowlist. As a result, the application will enqueue these events and treat them as legitimate, effectively bypassing the intended per-channel and DM allowlist controls.

All OpenClaw installations running any version prior to 2026.2.26 are vulnerable. The issue is present in the Node.js-based OpenClaw application, which processes Slack system events. No other vendors or products are affected.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is specifically a privilege‑escalation via authorization bypass (CWE‑863). EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker can send crafted Slack system events from an arbitrary, non‑allowlisted user. If successful, the attacker can disrupt or manipulate channel behavior by enqueuing unintended events, potentially leading to denial of service or unauthorized data manipulation.