VulnerabilityAnalyzed

CVE-2026-41365

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API.

MEDIUM 5.3EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.18% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-441
Affected: openclaw/openclaw
Source: disclosure@vulncheck.com

References

https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rjVendor Advisory
https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-historyThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.