N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rm2p-j3r7-4x4j

GHSA-rm2p-j3r7-4x4j: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Summary

OpenClaw Slack monitor handled reaction_* and pin_* non-message events before applying sender-policy checks consistently.

In affected versions, these events could be added to system-event context even when sender policy would not normally allow them.

Affected Packages / Versions

Package: npm openclaw
Latest published affected version confirmed: 2026.2.24 (npm latest as of February 26, 2026)
Affected range: <= 2026.2.24
Patched version : 2026.2.25

Technical Details

reaction_* and pin_* handlers now route through shared sender authorization (authorizeSlackSystemEventSender).
Enforced checks now include:
- DM dmPolicy / allowFrom
- channel users allowlist enforcement for non-DM channels
- channel-level allow checks before system-event enqueue
Regression coverage added for DM allow/deny and channel-user allowlist deny paths.

Fix Commit(s)

aedf62ac7e669a89c7b299201bf6537dc6b12e0e
75dfb71e4e8b7c2feba5a8ca662f92ea840e0147

Impact

Low-severity policy-consistency issue in Slack non-message event ingress. This may introduce unexpected reaction/pin context signals from senders outside configured policy.

Release Process Note

patched_versions is pre-set to planned release 2026.2.25. Advisory published with npm release 2026.2.25.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rm2p-j3r7-4x4j

GHSA-rm2p-j3r7-4x4j:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.24	2026.2.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the inconsistent application of sender authorization policies for non-message events, specifically reaction_* and pin_* events in the Slack and Discord integrations of OpenClaw. The analysis of the provided patches (aedf62ac7e669a89c7b299201bf6537dc6b12e0e and 75dfb71e4e8b7c2feba5a8ca662f92ea840e0147) reveals that the original code did not properly check if the user triggering these events was authorized according to the configured dmPolicy, allowFrom lists, or channel-specific user permissions.

The vulnerable functions were the event handlers responsible for processing these incoming events:

registerSlackReactionEvents (in src/slack/monitor/events/reactions.ts): The handler for reaction_added/removed events lacked sender validation, allowing unauthorized users to inject reaction-based system events.
handleSlackPinEvent (in src/slack/monitor/events/pins.ts): This function, called by the pin_added/removed event handlers, only checked channel-level permissions, not the sender's authorization, creating a similar bypass.
handleDiscordReactionEvent (in src/discord/monitor/listeners.ts): This handler was missing authorization checks for reactions occurring in Direct Messages, failing to enforce the dmPolicy.

The patches rectify these issues by introducing and consistently applying a centralized authorization function, authorizeSlackSystemEventSender for Slack, and adding specific authorization logic for Discord. This ensures that all incoming reaction_* and pin_* events are gated by the same sender policy checks as regular messages, closing the policy-consistency gap.

Vulnerable functions

registerSlackReactionEvents:eventHandler

src/slack/monitor/events/reactions.ts

The anonymous event handler within `registerSlackReactionEvents` for `reaction_added` and `reaction_removed` events was vulnerable. Before the patch, it lacked proper sender authorization checks. An attacker could send a reaction from an unauthorized account, and the system would process it, contrary to the configured policies. The fix introduces a call to `authorizeSlackSystemEventSender` to validate the sender before processing the event.

handleSlackPinEvent

src/slack/monitor/events/pins.ts

This function, which handles `pin_added` and `pin_removed` events, did not verify if the user pinning or unpinning an item was authorized. It only checked if the channel itself was allowed. This allowed any user in a channel to trigger a pin-related system event, bypassing sender-based policies like `dmPolicy` or channel-specific user allowlists. The patch enforces sender authorization by calling `authorizeSlackSystemEventSender`.

handleDiscordReactionEvent

src/discord/monitor/listeners.ts

The `handleDiscordReactionEvent` function was missing sender authorization checks for reactions in Direct Messages (DMs). This meant that if DMs were enabled, any user could trigger a reaction event, even if the `dmPolicy` was set to `allowlist` or `pairing` and the user was not authorized. The patch introduces the `isDirectReactionAuthorized` internal function to enforce the configured `dmPolicy` for reactions in DMs.

registerSlackPinEvents:eventHandler

src/slack/monitor/events/pins.ts

The anonymous event handler within `registerSlackPinEvents` for `pin_added` and `pin_removed` events was vulnerable as it called the `handleSlackPinEvent` function which lacked proper sender authorization checks. An attacker could send a pin event from an unauthorized account, and the system would process it, contrary to the configured policies. The fix introduces a call to `authorizeSlackSystemEventSender` inside `handleSlackPinEvent` to validate the sender before processing the event.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rm2p-j3r7-4x4j: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Summary

Affected Packages / Versions

Technical Details

Fix Commit(s)

Impact

Release Process Note

GHSA-rm2p-j3r7-4x4j:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

GHSA-rm2p-j3r7-4x4j: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Summary

Affected Packages / Versions

Technical Details

Fix Commit(s)

Impact

Release Process Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI