Openclaw Slack vulnerabilities

2 CVEs affecting Openclaw Slack, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-100575, published 2026-09-26.

More from Openclaw.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-100531, published 2026-09-26. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested…
• CVE-2026-100575, published 2026-09-26. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted…