Summary
OpenClaw Slack versions before 2026.8.1 do not consistently enforce sender allowlists in multi-person direct messages. A disallowed participant may trigger Slack agents and use the tools or access the data assigned to those agents when the message context includes multiple participants.
Affected context
The issue occurs in OpenClaw Slack deployments that use sender allowlists for agent interactions in multi-person direct messages. Risk is present when authorization decisions do not independently validate each participant before allowing an agent to process a message or perform an action.
Exploit preconditions
- Attack surface: Slack multi-person direct-message integration - Required access: Participation in, or ability to send messages to, a
conversation handled by the Slack agent
- Trigger point: Processing a message in a multi-person direct message - Why exploitation is possible: Sender authorization may be evaluated
incorrectly, allowing a participant outside the configured allowlist to
invoke an agent and inherit its permitted capabilities
Why this happens
The underlying bug is an authorization enforcement failure in which a sender allowlist is not applied correctly to every participant in a multi-person direct-message context. This maps to CWE-862, Missing Authorization, because the system can permit a protected operation without reliably confirming that the requesting sender is authorized for that operation.
Potential impact
- An unauthorized participant may trigger Slack agents
- An attacker could access tools exposed to the affected agent
- Sensitive data available to the agent may be disclosed
- Unauthorized actions could be performed through connected services
- The issue may weaken trust boundaries between Slack participants and agent capabilities
General mitigation guidance
Mitigation generally focuses on enforcing authorization for every message participant and every agent action, rather than relying on conversation-level assumptions. Secure-by-default designs can require explicit sender authorization before invocation, use deny-by-default policies, and bind tool and data permissions to the independently authenticated requester. Reducing input trust, separating privileged tools, applying least privilege to agent identities, and requiring confirmation for sensitive operations can limit exposure.
How teams detect issues like this
Detection approaches can include static analysis and code review for conversation-level authorization checks that do not identify the requesting participant, as well as tests covering allowed and disallowed users in multi-person direct messages. Runtime monitoring can compare Slack sender identities with allowlist decisions and record agent invocations, tool calls, and data access. Policy enforcement in CI and automated security review tools can help identify missing authorization checks and fail-open behavior.
