https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T20:09:55.787556+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28392 BREW-openclaw-cli-CVE-2026-28392 — OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands 2026-09-30T20:09:55.788654+00:00

Affected: Homebrew: openclaw-cli

## Summary

When Slack DMs are configured with `dmPolicy=open`, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.2.13` - Affected configuration: Slack DMs enabled with `channels.slack.dm.policy: open` (aka `dmPolicy=open`)

## Impact

Any Slack user in the workspace who can DM the bot could invoke privileged slash commands via DM.

## Fix

The slash-command path now computes `CommandAuthorized` for DMs using the same allowlist/access-group gating logic as other inbound paths.

Fix commit(s): - f19eabee54c49e9a2e264b4965edf28a2f92e657

## Release Process Note

`patched_versions` is set to the planned next release (`2026.2.14`). Once that npm release is published, this advisory should be published.

Thanks @christos-eth for reporting.

 https://db.gcve.eu/vuln/cve-2026-28392 CVE-2026-28392 — OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages 2026-09-30T20:09:55.788732+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.