OpenClaw Slack integration vulnerable to system prompt injection via channel metadata
OpenClaw's Slack integration allowed channel metadata to be incorporated into the model's system prompt, creating a prompt injection vulnerability. The issue was patched in version 2026.2.3 with no known exploitation reported.
What happened
When the Slack integration was enabled in OpenClaw, Slack channel metadata such as topic and description could be incorporated into the model's system prompt, creating an injection surface.
The vulnerability allowed untrusted Slack channel metadata to be treated as higher-trust system input, increasing the risk of prompt injection attacks against LLM-driven systems.
OpenClaw released patched versions (2026.2.3 and later) that separate untrusted channel metadata from system prompts for both Slack and Discord integrations.
Reported impact
No known exploitation of this vulnerability has been reported.
The impact depends on deployment configuration and operational controls.
Index analysis
This issue was characterized as a defense-in-depth hardening measure, with a CVSS score of 3.7 (Low severity).
The vulnerability required network access, high attack complexity, low privileges, and user interaction to exploit, with potential for low confidentiality and integrity impact.
Governance controls
Users not running the Slack integration required no action.
Users running the Slack integration were advised to upgrade to version 2026.2.3 or later.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.