CVE-2026-113799: slack-morphism HMAC Disclosure in Error Logs
Summary
CVE-2026-113799: Slack Morphism verifier errors disclose valid HMACs in the logs. Affects slack-morphism versions >= 1.0.0, < 2.28.0. Fixed in 2.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
slack-morphism is a Rust library designed to facilitate the integration of Slack's API with applications. It provides functionality for verifying Slack request signatures, ensuring that incoming requests are authentic and have not been tampered with. This library is crucial for applications that rely on Slack for events, commands, and interactions, as it helps maintain the integrity and security of communications between Slack and the application. However, a vulnerability has been identified that exposes sensitive information through error logs, potentially allowing attackers to bypass authentication mechanisms.
Vulnerability Detail
The vulnerability arises from the way slack-morphism handles signature verification errors. When a request with an invalid signature is received, the library computes the correct HMAC for the request and stores it in a public field of the error object. This generated HMAC is then exposed through the error's Debug and Display representations, which are logged at the error level by default. An attacker who can access the application's logs can exploit this by sending a crafted request, obtaining the correct HMAC from the logs, and then re-sending the request with the valid signature, thus bypassing authentication. This flaw poses a significant risk as it allows unauthorized access to protected application functionalities without needing the Slack signing secret.
How To Fix
Latest published version: 2.31.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.28.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, you can remove the public 'generated_hash' field from the 'SlackEventWrongSignatureError' type in your local copy of the library. This will prevent the exposure of the correct HMAC in error logs. However, this is not a permanent solution, and updating to the patched version is recommended.
Conclusion
The slack-morphism library has a significant vulnerability (CVE-2026-113799) that exposes valid HMACs through error logs, allowing potential attackers to bypass authentication. It is crucial to update to the latest version (2.28.0) to mitigate this risk. For immediate concerns, a temporary workaround is available, but a permanent fix through updating is strongly recommended.
See every vulnerability recorded for slack-morphism →
FAQ
CVE-2026-113799 is a vulnerability in the slack-morphism library that exposes valid HMACs in error logs, allowing attackers to bypass authentication.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities in real-time using your Cargo.lock file.
An attacker could exploit this vulnerability to gain unauthorized access to application functionalities that rely on Slack's request authentication.
Yes, a patched version (2.28.0) of the slack-morphism library is available. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update immediately, consider implementing the workaround by removing the public 'generated_hash' field from the error type to prevent HMAC exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for slack-morphism.
