## Slack Morphism verifier errors disclose valid HMACs in the logs

- 種別: advisory
- 重大度: medium
- 関連技術: rust, slack
- CVE: CVE-2026-113799
- 公開日時: 2026-10-21T16:38:47.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-26w4-8w32-4x3v)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-26w4-8w32-4x3v

影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0
Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…