OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.
References
Configurations
History
01 Apr 2026, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/openclaw/openclaw/commit/88aee9161e0e6d32e810a25711e32a808a1777b2 - Patch | |
| References | () https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq - Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-in-microsoft-teams-plugin-via-route-allowlist-configuration - Third Party Advisory | |
| First Time |
Openclaw openclaw
Openclaw |
|
| CPE | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
31 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
31 Mar 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 12:16
Updated : 2026-04-01 19:27
NVD link : CVE-2026-34506
Mitre link : CVE-2026-34506
CVE.ORG link : CVE-2026-34506
JSON object : View
Products Affected
openclaw
- openclaw
CWE
CWE-863
Incorrect Authorization