CVE-2026-32906 OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate

OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals through the exec approver gate. Attackers with limited exec approval permissions can bypass intended approval splits to approve plugin...

@chrysb/alphaclaw (>=0.8.7, <=0.9.16), @ericmmj/openclaw-weixin (>=2.2.4, <=2.2.5) +8 more potentially affected by CVE-2026-32906 via openclaw (>=0.0.1, <=2026.5.7)

openclaw NPM version =0.0.1, =0.8.7, =2.2.4, =4.0.0, =2.1.8, =0.1.0, =0.1.38, =3.3.2, =3.3.7 Source cves: CVE-2026-32906 Source advisory: MEND:CVE-2026-32906...