CVE-2026-34509

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.8

Description The software contains a sender allowlist bypass in its Microsoft Teams plugin. This allows unauthorized senders to bypass intended authorization checks. Specifically, when a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler creates wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.

Recommendations Update to version 2026.3.8 or later.