GHSA-4m3v-q747-pc6h: OpenClaw: Mattermost slash token revocation could lag until monitor refresh

Mattermost slash token revocation could lag until monitor refresh. In affected versions, a caller with an old Mattermost slash token during the refresh window could continue accepting the old token until the monitor refreshed.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw’s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.