CVE-2026-28392 is a privilege escalation flaw in OpenClaw's Slack slash-command handler. When dmPolicy is set to open, any direct message sender is treated as authorized to run privileged commands. NVD scores it 7.5. The GitHub advisory rates it Moderate. Upgrade openclaw to 2026.2.14 or later.
What's affected
The GitHub advisory GHSA-v773-r54f-q32w lists affected versions 2026.2.13 and earlier of the npm package openclaw, with 2026.2.14 as the patched version. The NVD text says versions prior to 2026.2.14.
The flaw is configuration dependent. It applies when Slack DMs are enabled with the policy channels.slack.dm.policy set to open, referred to as dmPolicy open. Deployments that use a stricter DM policy do not match the described condition.
The NVD record scores it 7.5 with an integrity impact and no authentication needed. The advisory rates it Moderate. Both numbers are worth reading: the first is a worst case, and the second reflects that the condition, an open DM policy, has to be chosen by the operator. The weakness is CWE-863 (Incorrect Authorization).
How to check if you're exposed
Check the version of OpenClaw in each project and global install.
npm ls openclaw
npm ls -g openclaw
Then check your Slack configuration for channels.slack.dm.policy. If it is set to open, you are in the described configuration. If it is an allow list or pairing policy, the advisory's condition is not met, but you should still upgrade.
What to do now
- Upgrade openclaw to 2026.2.14 or later.
- Review your Slack DM policy. Open is convenient and also widens who can reach the bot, so use an allow list if you can.
- Review which slash commands are privileged in your setup and who is meant to run them.
- Check Slack and bot logs for slash commands run by users who are not on your allow lists.
- Add the package to dependency monitoring.
Why it matters
The advisory explains the fix in one sentence: the slash-command path now computes command authorization for DMs using the same allowlist and access-group logic as the other inbound paths. That tells you the bug. One code path used a shortcut, and the shortcut said yes to everyone.
Authorization bugs of this type usually appear when a feature is added through a second route. The main message handler enforced the policy and the slash-command handler did not apply it. Every route into a privileged action has to apply the same check, and tests should cover each route.
The effect is that any Slack user who could DM the bot could run privileged slash commands, bypassing the intended allowlist and access groups. How serious that is depends on what those commands can do in your deployment.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Am I affected if my DM policy is not open?
The advisory describes the open policy as the affected configuration. Upgrade regardless, because the fix is a routine version bump.
Why do NVD and the advisory differ on severity?
NVD scores the weakness at 7.5. The maintainers rate it Moderate because an operator must choose the open policy.
Sources
Last reviewed: 19 October 2026.
