GHSA-c29c-2q9c-pc86: OpenClaw: Slack allowFrom could bind to mutable display names

allowFrom decides which Slack identities may talk to the agent. In affected versions, the match could use display-name metadata. Display names are chosen by the user and can be changed at will, so they are not identity. A Slack account could set its display name to match a policy entry written for another person.

The attacker needs a Slack account that can reach the OpenClaw channel and is allowed to edit its own display name. That is low privilege, and no exploit tooling is needed: rename the account. The CWE is authentication bypass by spoofing (CWE-290). The vector scores high confidentiality and integrity impact because the agent acts on the sender's behalf. A spoofed sender gets whatever the impersonated person could do through the agent, including its tools and any data it can read.

The advisory keeps the trusted-operator model unchanged and says real exposure depends on configuration and on whether lower-trust Slack users can reach the path.

The npm package openclaw at 2026.5.3-1 and earlier, with the Slack channel enabled and allowFrom entries that are display names rather than user IDs.

npm ls openclaw

Use npm ls -g openclaw for a global install. Also open your Slack allowFrom entries and note any that are names and not IDs.

Upgrade to [email protected], which the advisory names as the first stable patched version:

npm install [email protected]

The affected range runs to 2026.5.3-1, which is a later string than 2026.5.3. This is a mismatch in the advisory data. Check the release notes for the exact version, and prefer a newer release than both. Until you upgrade, use stable Slack user IDs in allowFrom, keep channel and tool allowlists narrow, and avoid sharing one Gateway between mutually untrusted users.

Look at your Slack allowFrom list for entries that are display names. Check who has talked to the agent in Slack and whether any account's display name changed around that time, using the workspace's profile change history if you have it. Match sender user IDs in the Gateway logs against the IDs of the people you meant to allow. The advisory gives no log line.

Summary

Slack allowFrom could bind to mutable display names. In affected versions, a Slack account able to change display name metadata could match a policy entry through mutable display metadata.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could receive agent access intended for another Slack identity. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.3.

Mitigations

use stable Slack user IDs in allowlists until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.