OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
Summary
In openclaw MS Teams file-consent flow, pending uploads were authorized by uploadId alone. fileConsent/invoke did not verify the invoke conversation against the conversation that created the pending upload.
Impact
An attacker who obtained a valid uploadId within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).
Technical Details
- Pending uploads stored
conversationId, but invoke handling consumed byuploadIdonly. - The invoke path did not enforce conversation binding before
uploadToConsentUrl(...)and pending-upload removal. - Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version (as of February 26, 2026):
2026.2.24 - Vulnerable range:
<= 2026.2.24 - Patched in release:
2026.2.25
Remediation
Upgrade to openclaw 2026.2.25 (or later) once published.
Fix Commit(s)
347f7b9550064f5f5b33c6e07f64e85b9657b6f1
Release Process Note
patched_versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.
OpenClaw thanks @tdjackey for reporting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.25 | 2026.2.25 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-639, CWE-862- Platform
- npm
- Package
openclaw- Disclosed
- 03.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j26j-7qc4-3mrf - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.