CVE-2026-28481

OpenClaw (npm package) up to version 2026.1.30 contains an information disclosure vulnerability in the MS Teams attachment downloader (extension must be enabled). When retrying downloads after 401/403 responses, the code may send Authorization: Bearer tokens to untrusted hosts that match a permis...