OpenClaw releases before 2026.5.3 allow attackers who can access a Slack account to manipulate the display name of that account. The application’s allowFrom feature, which is intended to restrict agent access based on specific Slack identities, incorrectly treats mutable display names as immutable policy identifiers. By changing a display name to match an entry that grants higher privileges, an attacker can gain unauthorized agent access that should belong to a different user. This flaw represents a classic privilege escalation vulnerability that could allow an attacker to read or modify data, execute arbitrary code, or take ownership of the system tied to the elevated agents.

OpenClaw, version 2026.5.2 and earlier. The vulnerability is tied to the open-source Slack integration and affects any deployment of the OpenClaw application running an affected version. No other vendor or product is listed as affected.

The CVSS score of 8.6 indicates high severity. EPSS data is not available, so the overall exploitation probability cannot be quantified, but the flaw already appears in open‑source code with mainstream Slack usage, suggesting a non‑negligible likelihood. The vulnerability is not listed in the CISA KEV catalog, however, its exploit mechanics are straightforward: an attacker who can control a Slack display name can bypass access controls. No external conditions beyond Slack account access are required, making the attack path readily achievable.