PT-2026-44892 · Slack · Openclaw

Dikai Zou · Published 2026-05-29 · Updated 2026-07-02 · CVE-2026-32906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description A privilege escalation issue exists in Slack plugin approvals. This allows users with exec-authorized permissions to resolve plugin approvals via the exec approver gate, enabling them to bypass intended approval splits and approve plugin actions that fall outside the operator configuration.

Recommendations Update to version 2026.5.12.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-32906

GHSA-WV26-J37Q-2G7P

Affected Products

Openclaw

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32906.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wv26-j37q-2g7p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32906 · Security Note
• https://osv.dev/vulnerability/GHSA-wv26-j37q-2g7p · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-privilege-escalation-in-slack-plugin-approvals-via-exec-approver-gate · Note