https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:31:53 +0000 https://vulnerability.circl.lu/vuln/cve-2026-34506 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.</p> https://vulnerability.circl.lu/vuln/cve-2026-34506 https://vulnerability.circl.lu/vuln/ghsa-g7cr-9h7q-4qxq <p><strong>Affected:</strong> npm: openclaw</p> <p>OpenClaw&#39;s Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but `groupAllowFrom` was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowing any sender in the matched team/channel to bypass the intended `groupPolicy: &#34;allowlist&#34;` sender check.</p> <p>This does not affect default unauthenticated access, but it does weaken a documented Teams group authorization boundary and can allow unauthorized group senders to trigger replies in allowlisted Teams routes.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Latest published vulnerable version: `2026.3.7` - Affected range: `&lt;= 2026.3.7` - Fixed in released version: `2026.3.8`</p> <p>## Fix Commit(s)</p> <p>- `88aee9161e0e6d32e810a25711e32a808a1777b2`</p> <p>## Release Verification</p> <p>- Verified fixed in GitHub release `v2026.3.8` published on March 9, 2026. - Verified `npm view openclaw version` resolves to `2026.3.8`. - Verified the release contains the regression test covering the Teams route-allowlist sender-bypass case and that the test passes against the `v2026.3.8` tree.</p> <p>Thanks @zpbrent for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>OpenClaw&#39;s Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but `groupAllowFrom` was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowing any sender in the matched team/channel to bypass the intended `groupPolicy: &#34;allowlist&#34;` sender check.</p> <p>This does not affect default unauthenticated access, but it does weaken a documented Teams group authorization boundary and can allow unauthorized group senders to trigger replies in allowlisted Teams routes.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Latest published vulnerable version: `2026.3.7` - Affected range: `&lt;= 2026.3.7` - Fixed in released version: `2026.3.8`</p> <p>## Fix Commit(s)</p> <p>- `88aee9161e0e6d32e810a25711e32a808a1777b2`</p> <p>## Release Verification</p> <p>- Verified fixed in GitHub release `v2026.3.8` published on March 9, 2026. - Verified `npm view openclaw version` resolves to `2026.3.8`. - Verified the release contains the regression test covering the Teams route-allowlist sender-bypass case and that the test passes against the `v2026.3.8` tree.</p> <p>Thanks @zpbrent for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-g7cr-9h7q-4qxq