Iniciar sesión
Deutsch English Español Polski
Media

OpenClaw MS Teams inbound attachment downloader leaks bearer tokens to allowlisted suffix domains

  • Publicada: 17.02.2026
  • Actualizado: 11.10.2026 10:22

Summary

NOTE: This only affects deployments that enable the optional MS Teams extension (Teams channel). If you do not use MS Teams, you are not impacted.

When OpenClaw downloads inbound MS Teams attachments / inline images, it may retry a URL with an Authorization: Bearer <token> header after receiving 401 or 403.

Because the default download allowlist uses suffix matching (and includes some multi-tenant suffix domains), a message that references an untrusted but allowlisted host could cause that bearer token to be sent to the wrong place.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Vulnerable: <= 2026.1.30
  • Patched: >= 2026.2.1

Fix

  • Fix commit: 41cc5bcd4f1d434ad1bbdfa55b56f25025ecbf6b
  • Upgrade to openclaw >= 2026.2.1

Workarounds

  • If you do not need MS Teams, disable the MS Teams extension.
  • If you must stay on an older version, ensure the auth host allowlist is strict (only Microsoft-owned endpoints that require auth) and avoid wildcard or broad suffix entries.

Credits

Thanks @yueyueL for reporting.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm openclaw < 2026.2.1 2026.2.1

Referencias

Puntuación CVSS 7.4/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Debilidad (CWE)
CWE-201
Plataforma
npm
Paquete
openclaw
Publicada
17.02.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-7vwx-582j-j332 - CC BY 4.0

Historial de vulnerabilidades: openclaw

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (589) en el archivo
Entradas en total
589
Primera → última
02.2026 10.2026
Sin corrección
9
Explotada en ataques
0

Distribución por gravedad

  • Crítica 20
  • Alta 215
  • Media 300
  • Baja 54

Divulgaciones por año

Gravedad:
  1. OpenClaw MS Teams inbound attachment downloader leaks bearer tokens to allowlisted suffix domains esta entrada
    Media · 7.4 CVE-2026-28481 < 2026.2.1 2026.2.1
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    Alta CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Alta · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Alta CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Alta CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    Alta · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Alta · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Alta · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    Alta · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Alta · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Alta · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Alta · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Crítica CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Alta · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    Alta CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Alta · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Alta · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Alta · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Alta · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Alta · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Alta · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  22. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Alta · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  23. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Alta · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  24. OpenClaw: Shell wrapper argv could change between approval and execution
    Alta CVE-2026-53822 < 2026.5.18 2026.5.18
  25. OpenClaw: Exec approval display truncation could hide the command being approved
    Alta · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  26. OpenClaw: Message read actions could skip channel allowlist checks
    Alta · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  27. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Alta · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  28. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Alta · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  29. OpenClaw: Discord allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  30. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Alta · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  31. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Alta · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  32. OpenClaw: Zalo allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  33. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Alta · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  34. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Alta · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  35. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Alta · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  36. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Alta · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  37. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Alta · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  38. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Alta · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  39. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Alta · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  40. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Alta · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  41. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Alta · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  42. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Alta · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  43. OpenClaw: Feishu webhook and card-action validation now fail closed
    Crítica · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  44. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Crítica · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  45. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Alta CVE-2026-43533 < 2026.4.10 2026.4.10
  46. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Alta · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  47. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Alta · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  48. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Alta · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  49. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Alta · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  50. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Alta CVE-2026-43581 < 2026.4.10 2026.4.10
  51. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Alta · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  52. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Alta · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  53. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Alta · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  54. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Alta CVE-2026-43528 < 2026.4.14 2026.4.14
  55. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Alta CVE-2026-40037 < 2026.4.8 2026.4.8
  56. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Alta · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  57. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Alta CVE-2026-42427 < 2026.4.8 2026.4.8
  58. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Alta ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  59. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Alta ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  60. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Alta · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  61. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Alta · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  62. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Alta CVE-2026-34511 < 2026.4.2 2026.4.2
  63. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Alta CVE-2026-41393 < 2026.3.31 2026.3.31
  64. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Alta · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  65. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Alta CVE-2026-41353 < 2026.3.22 2026.3.22
  66. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Alta · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  67. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Crítica · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  68. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Alta · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  69. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Alta CVE-2026-41404 < 2026.3.31 2026.3.31
  70. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Alta CVE-2026-41349 < 2026.3.28 2026.3.28
  71. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Alta · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  72. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Alta · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  73. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Alta · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  74. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Alta CVE-2026-41366 < 2026.3.31 2026.3.31
  75. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Alta · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  76. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Alta · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  77. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Alta · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  78. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Alta · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  79. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Crítica CVE-2026-41329 < 2026.3.31 2026.3.31
  80. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Alta · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  81. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Crítica · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  82. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    Alta · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  83. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    Alta CVE-2026-41371 < 2026.3.28 2026.3.28
  84. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    Alta · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  85. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    Alta · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  86. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    Alta CVE-2026-41299 < 2026.3.28 2026.3.28
  87. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    Alta · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  88. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    Alta · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  89. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    Alta · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  90. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    Alta · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  91. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    Alta · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  92. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Crítica CVE-2026-33579 < 2026.3.28 2026.3.28
  93. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    Alta CVE-2026-41395 < 2026.3.28 2026.3.28
  94. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    Alta · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  95. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    Alta CVE-2026-35621 < 2026.3.24 2026.3.24
  96. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    Alta · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  97. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    Alta · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  98. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    Alta CVE-2026-35629 < 2026.3.28 2026.3.28
  99. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    Alta CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  100. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    Alta CVE-2026-35669 <= 2026.3.24 sin corrección
  101. OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
    Crítica CVE-2026-35625 <= 2026.3.24 sin corrección
Mostrar más (20) Mostrando 101 de 236

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.