CVE-2026-24764

OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openclaw/openclaw/commit/35eb40a7000b59085e9c638a80fd03917c7a095e	Patch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.3	Product Release Notes
https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-02-19 07:17

Updated : 2026-02-19 18:30

NVD link : CVE-2026-24764

Mitre link : CVE-2026-24764

CVE.ORG link : CVE-2026-24764

JSON object : View

Products Affected

openclaw

openclaw

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-24764", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "published": "2026-02-19T07:17:44.957", "references": [{"url": "https://github.com/openclaw/openclaw/commit/35eb40a7000b59085e9c638a80fd03917c7a095e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3."}, {"lang": "es", "value": "OpenClaw (anteriormente Clawdbot) es un asistente de IA personal que los usuarios ejecutan en sus propios dispositivos. En las versiones 2026.2.2 e inferiores, cuando la integraci\u00f3n de Slack est\u00e1 habilitada, los metadatos del canal (tema/descripci\u00f3n) pueden incorporarse al prompt del sistema del modelo. La inyecci\u00f3n de prompts es un riesgo documentado para los sistemas impulsados por LLM. Este problema aumenta la superficie de inyecci\u00f3n al permitir que los metadatos no confiables del canal de Slack sean tratados como entrada del sistema de mayor confianza. Este problema ha sido solucionado en la versi\u00f3n 2026.2.3."}], "lastModified": "2026-02-19T18:30:39.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "AB694F3B-E1D5-4980-8413-808F7AABF7F1", "versionEndExcluding": "2026.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}