Slack vulnerabilities and fixes

CVEs that mention Slack, ranked by priority. 14 tracked.

Slack has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-10-23. Highest priority: CVE-2026-109444 (score 57/100).

• CVE-2026-109444 CRITICAL 9.8 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute
• CVE-2026-47724 CRITICAL 9.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-67428 HIGH 8.5 Flyto2 Core is an execution kernel for automation and AI-agent workflows
• CVE-2026-49258 HIGH 8.8 Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN
• CVE-2026-47722 HIGH 8.7 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-48025 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-47726 HIGH 7.1 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-56835 HIGH 8.3 PraisonAI is a multi-agent teams system
• CVE-2026-47723 HIGH 7.1 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-47725 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-48058 MEDIUM 4.6 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-113799 MEDIUM 5.3 Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit
• CVE-2026-47768 MEDIUM 5.5 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-114072 MEDIUM 4.3 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-l

FAQ

How do I fix Slack vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Slack being exploited right now?

None of the tracked Slack CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Slack CVE should I patch first?

CVE-2026-109444 currently ranks highest (57/100): OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute.

← Back to latest CVEs