CVE-2026-32037
CVE-2026-32037 · OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.
CVSS 2.3 · Faible · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
Sources originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-w76h-8m22-hpgh
- https://github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5c
- https://github.com/openclaw/openclaw/commit/b34097f62df9d1960cc22600269cd3f3284e2124
- https://www.vulncheck.com/advisories/openclaw-redirect-chain-bypass-of-media-host-allowlist-in-msteams-attachment-handling
- https://nvd.nist.gov/vuln/detail/CVE-2026-32037