This vulnerability occurs because OpenClaw does not apply the sender allowlist when filtering Slack thread context. As a result, messages from users who are not on the allowlist can be included in the context supplied to the language model. An attacker can exploit this by sending a message through a reply that appears to come from an allowlisted user, thereby injecting unauthorized content into the model’s context and potentially manipulating the model’s responses or causing it to reveal sensitive information. This flaw aligns with CWE‑346, which concerns missing validation of a security‑relevant credential.

The affected product is OpenClaw by OpenClaw. Versions before 2026.4.2 are vulnerable. No additional vendor or product versions are listed.

The CVSS score of 2.3 indicates a low severity, and the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest that exploitation is unlikely in the wild. However, the attack likely requires the ability to post messages on a Slack channel that the OpenClaw instance monitors and to do so via an allowlisted user’s reply. If these conditions are met, the attacker can manipulate the model’s context without elevating privileges. The overall risk remains low, but the impact on model integrity warrants attention.