Privilege Escalation via Slack Display Name Spoofing in OpenClaw

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: VulnCheck

Description

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other identities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-02

NVD

CVE-2026-53823

EUVD

EUVD-2026-36611

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.3 and involves a privilege escalation issue in the allowFrom feature. The feature binds to mutable Slack display names, which attackers with access to a Slack account can manipulate. By changing their Slack display name metadata to match policy entries, attackers can potentially gain unauthorized agent access that is intended for other identities.

Impact Analysis

The vulnerability can allow attackers who have access to a Slack account to escalate their privileges within OpenClaw. By altering their Slack display name to match certain policy entries, they may gain unauthorized access to agent functions or data that should be restricted to other users. This could lead to unauthorized actions or data exposure within the affected system.

Hi! I’m here to help you understand CVE-2026-53823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70