CVE-2026-62212

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.28

Description A race condition exists in the MS Teams safeFetch DNS rebinding check. When this feature is enabled and reachable, a lower-trust caller or configured input path can exploit a timing window between the DNS validation check and its subsequent use. This allows the execution of actions that should have required a stronger authorization or policy check. DNS rebinding is a technique used to bypass the Same-Origin Policy (SOP) by manipulating DNS responses to trick a browser into thinking a malicious site is a trusted one.

Recommendations Update to version 2026.5.28 or later.