CVE-2026-100550

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description An access-control bypass exists in the Microsoft Teams integration. When the groupPolicy is configured as allowlist, a missing or unsupported access group results in a denied group-resolution that the final message-admission check fails to reject. This allows a Microsoft Teams member who is not on the allowlist to trigger the configured agent, bypassing the administrator's group boundary. The potential impact depends on the tools, data, and conversations accessible to the agent.

Recommendations Update to version 2026.8.1.