Incorrect authorization in OpenClaw - #VU132712
Published: May 29, 2026
Vulnerability identifier: #VU132712
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass intended approval restrictions.
The vulnerability exists due to improper access control in the Slack plugin approval gate when handling plugin approval actions. A remote user can resolve a plugin approval through the exec approver gate to bypass intended approval restrictions.
Exploitation requires the affected feature to be enabled and reachable.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.5.12