p PatchFirst

CVE-2026-34506

CVE-2026-34506 · OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.

CVSS 2.3 · Baja · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 2026.3.8: Afectada (semver)
    • 2026.3.8: No afectada (semver)

    Actualiza a 2026.3.8

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.3.8

    Actualiza a 2026.3.8

Fuentes originales

Comprueba tu servidor →