p PatchFirst

CVE-2026-41358

CVE-2026-41358 · OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context. Attackers can inject unauthorized thread messages through allowlisted user replies to bypass sender access controls and manipulate model context.

CVSS 2.3 · Low · EPSS 0.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.4.2: Affected (semver)
    • 2026.4.2: Not affected (semver)

    Update to 2026.4.2

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.4.2

    Update to 2026.4.2

Original sources

Check your server →