Executive brief
OpenClaw is a tool used to download and process attachments from Microsoft Teams messages. A vulnerability in its attachment downloader can inadvertently send authentication credentials (bearer tokens) to untrusted domains that match the suffix-based allowlist. An attacker who can craft a message referencing a malicious but allowlisted domain could intercept these credentials, potentially gaining unauthorized access to Microsoft cloud services or sensitive resources.
Technical details
OpenClaw's MS Teams attachment downloader implements suffix-based domain matching in its authorization allowlist. When receiving a 401 or 403 response, the tool retries the request with an Authorization: Bearer token header. Due to overly permissive suffix matching (including multi-tenant Microsoft domains), an attacker can craft a message referencing an untrusted but allowlisted host, causing the bearer token to be sent to the wrong recipient. This is a sensitive information disclosure vulnerability (CWE-201). The attack requires user interaction to process a malicious message in Teams. The fix is available in version 2026.2.1 and later; users can temporarily mitigate by disabling the MS Teams extension or using strict host allowlists.
Affected products
- OpenClaw openclaw <= 2026.1.30
Timeline
- 2026-02-14: disclosed
- 2026-02-01: patched: Fix commit 41cc5bcd4f1d434ad1bbdfa55b56f25025ecbf6b available in version 2026.2.1 or later
- 2026-02-17: advisory