OpenClaw versions older than 2026.5.12 contain a flaw in the Slack plugin approval flow. This flaw allows users who have exec approval permissions to resolve plugin approvals through the exec approver gate, bypassing the intended split of approval authority. The result is that an attacker with limited exec approval rights can approve plugin actions that are normally outside the operator's configuration scope, effectively escalating privileges by authorizing potentially malicious plugin execution. The weakness is a classic example of improper authorization (CWE‑863).

The affected product is OpenClaw before version 2026.5.12. The vulnerability exists in the OpenClaw platform, which runs on a Node.js environment. End users running any earlier release of OpenClaw are susceptible. No specific sub‑components or additional products are mentioned.

The CVSS score of 2.3 indicates a low severity impact from a security point of view. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attack likely requires the attacker to be authenticated with exec approval privileges within the OpenClaw instance; from there they can manipulate Slack plugin approvals via the API or web interface. Because the exploit depends on existing exec rights, the likelihood is limited to compromised or poorly configured accounts, and the risk to the broader environment remains moderate, not critical.