High severity8.8NVD Advisory· Published Sep 26, 2026· Updated Oct 8, 2026
CVE-2026-100575
CVE-2026-100575
Description
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2News mentions
1- OpenClaw: 25 Authorization Bypass and Access Control Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 26, 2026