Vulnerabilities

TI-2026-26758 CVE-2026-34506 · GHSA-g7cr-9h7q-4qxq

OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

LOW 18

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00272 Published 2026-03-31 Fixed in 2026.3.8 CWE-863

TI-2026-25369 CVE-2026-32921 · GHSA-8g75-q649-6pv6

OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run

LOW 23

OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00203 Published 2026-03-31 Fixed in 2026.3.8 CWE-367

Vulnerabilities

Filters

OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run