CVE-2026-34509

OpenClaw versions before 2026.3.8 are vulnerable to a sender allowlist bypass in the Microsoft Teams plugin. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization . This allows unauthorized senders t...

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

OpenClaw's Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but groupAllowFrom was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowi...