OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.
| Vendor | Product | Versions |
|---|---|---|
| openclaw | openclaw | 0 |
Updated description with technical details, added affected version 2026.3.7, changed severity to HIGH, set CVSS estimate to 7.5, and noted that exploit is not available.
Initial creation
