Description
OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openclaw | msteams | < 2026.5.27 | 2026.5.27 |
Advisories 1
- WID-SEC-2026-2133 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2026
References
- GitHub Security Advisory (GHSA-v54h-q2vx-vgg4) vendor-advisory
- VulnCheck Advisory: OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests third-party-advisory