CVE-2026-34506
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
OpenClaw before version 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, allowing unauthorized senders to trigger replies in allowlisted Teams routes.
Risk Assessment
An unauthorized sender can send messages to Teams channels, potentially leading to information leakage or unauthorized actions.
Recommendation
Upgrade OpenClaw to version 2026.3.8 or later. If an update is not possible, ensure the groupAllowFrom parameter is not empty in the route allowlist configuration.
Original NVD description (English source)
OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.