PT-2026-27028
تاريخ النشر
2026-03-12
·
تاريخ التحديث
2026-03-12
الوصف من
CVSS 4.0
5.3
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
Slack
member * and message subtype system events (message changed, message deleted, thread broadcast) were not consistently enforcing sender authorization before enqueueing system events.Affected Packages / Versions
- Package:
openclaw(npm) - Latest published version:
2026.2.25 - Affected range:
<= 2026.2.25 - Planned patched version:
2026.2.26(pre-set for publish-readiness)
Technical Details
Slack system-event handlers in
src/slack/monitor/events/members.ts and src/slack/monitor/events/messages.ts enqueued events after channel checks without shared sender authorization. Deployments relying on Slack DM allowlists (dmPolicy / allowFrom) or per-channel users allowlists could receive unauthorized system-event ingress from non-allowlisted senders.The fix routes those handlers through
authorizeAndResolveSlackSystemEventContext(...) and fails closed when message subtype sender identity cannot be resolved.Fix Commit(s)
3d30ba18a2aba1e1b302e77ff33145c3b06c01c8
Release Process Note
patched versions is pre-set to >= 2026.2.26 so once npm 2026.2.26 is published, this advisory can be published without further field edits.Thanks @tdjackey for reporting.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾