CVE Catalog
CVE-2026-41365
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.18%
7th percentile - higher than 7% of all known CVEs
Summary
OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.
Risk Assessment
An attacker can access confidential messages that should be hidden, potentially leading to information leakage.
Recommendation
Update OpenClaw to version 2026.3.31 or later, which contains the fix.
Original NVD description (English source)
OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.