vulnerability · openclaw

MS Teams message actions could miss requester authorization

MS Teams message actions could miss requester authorization. The official advisory identifies openclaw >= 2026.4.12-beta.1, < 2026.6.6 as affected.

high severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?: MS Teams message actions could miss requester authorization. The official advisory identifies openclaw >= 2026.4.12-beta.1, < 2026.6.6 as affected.
Who is affected?: openclaw >= 2026.4.12-beta.1, < 2026.6.6
What should defenders do?: Upgrade openclaw to 2026.6.6 or later.
Is a fix available?: Yes. Upgrade to 2026.6.6.

01 / Response

Upgrade openclaw to 2026.6.6 or later.
Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.

02 / Technical assessment

OpenClaw's official security advisory assigns high severity with CVSS 7.1 and references CWE-862, CWE-863.

Official advisory: MS Teams message actions could miss requester authorization.
Affected range: >= 2026.4.12-beta.1, < 2026.6.6. First patched version: 2026.6.6.

03 / Timeline