CVE-2026-28392: OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28392?
CVE-2026-28392 has a medium severity rating due to its potential for privilege escalation.
How do I fix CVE-2026-28392?
To fix CVE-2026-28392, upgrade OpenClaw to version 2026.2.14 or later, ensuring that dmPolicy is configured correctly.
What versions are affected by CVE-2026-28392?
OpenClaw versions prior to 2026.2.14 are affected by CVE-2026-28392.
What type of vulnerability is CVE-2026-28392?
CVE-2026-28392 is classified as a privilege escalation vulnerability.
How can CVE-2026-28392 impact my organization?
CVE-2026-28392 can allow unauthorized users to execute commands with elevated permissions through Slack direct messages.