CVE-2026-24764: Openclaw Prompt Injection Vulnerability

CVE-2026-24764 Overview

OpenClaw (formerly Clawdbot) is a personal AI assistant that users run on their own devices. A prompt injection vulnerability exists in versions 2026.2.2 and below when the Slack integration is enabled. The vulnerability allows channel metadata (topic/description) to be incorporated into the model's system prompt, expanding the injection surface by treating untrusted Slack channel metadata as higher-trust system input.

Critical Impact

Untrusted Slack channel metadata can be injected into the LLM system prompt, potentially allowing attackers to manipulate AI assistant behavior and bypass intended operational constraints.

Affected Products

• OpenClaw versions 2026.2.2 and below
• OpenClaw for Node.js with Slack integration enabled

Discovery Timeline

• 2026-02-19 - CVE-2026-24764 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-24764

Vulnerability Analysis

This vulnerability represents a Prompt Injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in the OpenClaw AI assistant's Slack integration module. When users enable the Slack integration, the application fetches channel metadata including topic and description fields and incorporates this data into the LLM's system prompt context.

The fundamental issue is that Slack channel metadata is user-controllable content that any channel member with appropriate permissions can modify. By treating this external, low-trust data as system-level input, OpenClaw creates an expanded attack surface for prompt injection attacks. An attacker could craft malicious channel topics or descriptions containing adversarial instructions designed to override the AI's behavioral constraints, extract sensitive information, or cause the assistant to perform unintended actions.

Root Cause

The root cause stems from insufficient trust boundary enforcement in the Slack integration component. The application fails to properly classify Slack channel metadata as untrusted user input, instead treating it with the same privilege level as system configuration. This design flaw allows external actors who can modify Slack channel properties to inject content directly into the LLM's system prompt, bypassing normal input sanitization controls that would apply to regular user messages.

Attack Vector

The attack requires network access and relies on an attacker having the ability to modify Slack channel metadata in a workspace where OpenClaw is integrated. The attacker would craft a malicious channel topic or description containing prompt injection payloads. When OpenClaw processes this channel and incorporates the metadata into its system prompt, the injected content could manipulate the AI's behavior.

The attack complexity is high as it requires both user interaction and specific circumstances (the victim must be using the Slack integration and processing channels where the attacker can modify metadata). The impact is limited to low confidentiality and integrity exposure without availability impact.

Detection Methods for CVE-2026-24764

Indicators of Compromise

• Unusual or suspicious content in Slack channel topics or descriptions containing prompt-like instructions
• Unexpected AI assistant behaviors that deviate from configured constraints
• Slack channel metadata containing encoded payloads or system-style instructions
• Audit logs showing channel metadata modifications from unexpected users

Detection Strategies

• Monitor Slack channel metadata changes for suspicious patterns or instruction-like content
• Implement logging for all content incorporated into LLM system prompts
• Review AI assistant outputs for signs of behavioral manipulation or constraint bypass
• Analyze Slack audit logs for unusual channel property modification patterns

Monitoring Recommendations

• Enable verbose logging in OpenClaw to track all Slack metadata processing
• Set up alerts for Slack channel topic/description changes containing suspicious keywords
• Monitor AI assistant response patterns for anomalies suggesting prompt injection
• Review integration logs regularly for unexpected metadata content

How to Mitigate CVE-2026-24764

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.3 or later immediately
• Review and audit Slack channel metadata in channels where OpenClaw is integrated
• Temporarily disable Slack integration if upgrade is not immediately possible
• Review AI assistant logs for evidence of past exploitation attempts

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.3. The fix is available through the official release at the GitHub Release v2026.2.3. The specific commit addressing this issue can be reviewed at the GitHub Commit Update. Additional details are available in the GitHub Security Advisory GHSA-782p-5fr5-7fj8.

Workarounds

• Disable the Slack integration until the patch can be applied
• Restrict Slack channel metadata modification permissions to trusted administrators only
• Implement monitoring for channel topic and description changes
• Configure the AI assistant with additional defensive prompt engineering to resist injection attempts

# Upgrade OpenClaw to patched version
npm update openclaw@2026.2.3

# Verify installation version
npm list openclaw

# If upgrade not possible, disable Slack integration in configuration
# openclaw.config.js
# integrations: { slack: { enabled: false } }