Lucene search
+L

1291 matches found

Github Security Blog
Github Security Blog
added 2026/03/31 12:31 p.m.13 views

Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g7cr-9h7q-4qxq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows...

4.3CVSS5.8AI score0.00267EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 2026/03/31 12:16 p.m.12 views

CVE-2026-34509

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

0.00025EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/03/31 11:17 a.m.32 views

CVE-2026-34509

...

0.00025EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/03/31 11:17 a.m.4 views

CVE-2026-34509

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

7.5CVSS5.9AI score0.00025EPSS
SaveExploits0References4
CVE
CVE
added 2026/03/31 11:17 a.m.19 views

CVE-2026-34509

OpenClaw CVE-2026-34509 affects the Microsoft Teams plugin prior to version 2026.3.8. The vulnerability is a sender allowlist bypass: if a team/channel route allowlist uses an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, allowing any sender within...

4.3CVSS5.9AI score0.00025EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/03/31 11:17 a.m.8 views

CVE-2026-34509 OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

4.3CVSS5.9AI score0.00025EPSS
SaveExploits0References3
OSV
OSV
added 2026/03/31 11:17 a.m.12 views

CVE-2026-34506 OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

2.3CVSS6AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/03/31 11:17 a.m.4 views

CVE-2026-34506 OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

4.3CVSS5.9AI score0.00267EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/03/31 11:17 a.m.37 views

CVE-2026-34506 OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

4.3CVSS0.00267EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/03/31 9:11 a.m.13 views

cpython: email header injection due to unquoted newlines

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules,...

6CVSS5.8AI score0.00533EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/03/31 12:00 a.m.18 views

PT-2026-29258

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28 Description The software contains a sender policy bypass issue in the Google Chat and Zalouser extensions. Route-level group allowlist policies are silently downgraded to open policy, allowing attackers to...

9.8CVSS5.9AI score0.00297EPSS
SaveExploits0References9
CNNVD
CNNVD
added 2026/03/31 12:00 a.m.17 views

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.8 contained security vulnerabilities. These vulnerabilities stemmed from a bypass of the sender whitelist in Microsoft Teams plugins, which could allow unauthorized senders to...

4.3CVSS5.8AI score0.00025EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/03/31 12:00 a.m.16 views

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a sender policy bypass vulnerability that can be exploited by an attacker to bypass sender restrictions and interact with the bot...

5.3CVSS5.8AI score0.00297EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/03/31 12:00 a.m.26 views

PT-2026-29239

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesiz...

7.5CVSS5.9AI score0.00025EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/03/31 12:00 a.m.36 views

PT-2026-29256

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected...

9.8CVSS5.9AI score0.00355EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/03/30 7:06 p.m.11 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization through the handleSendPolicyCommand function. An attacker can persistently alter the session's delivery policy by issuing /send on|off|inherit commands as a...

5.4CVSS5.9AI score
SaveExploits0References2
OSV
OSV
added 2026/03/30 7:06 p.m.10 views

GHSA-39MP-545Q-W789 OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy

Fixed in OpenClaw 2026.3.24, the current shipping release. Title Non-owner command-authorized sender can change the owner-only /send session delivery policy CWE CWE-285 Improper Authorization CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base score: 5.4 Medium Severity Assessment Medium...

5.4CVSS5.9AI score0.00442EPSS
SaveExploits1References8
Snyk
Snyk
added 2026/03/29 3:49 p.m.9 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the feedback invocation process. An attacker can record unauthorized session feedback or trigger feedback reflection by bypassing sender allowlist checks...

6.9CVSS5.9AI score0.00227EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/03/29 3:49 p.m.14 views

OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

Summary MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Microso...

6.9CVSS5.9AI score0.00227EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/03/29 3:49 p.m.27 views

GHSA-RF6H-5GPW-QRGQ OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

Summary MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Microso...

6.9CVSS5.9AI score0.00227EPSS
SaveExploits0References3
Rows per page
Query Builder