Executive brief
OpenClaw is a JavaScript library that handles integration with Microsoft Teams, including downloading and processing media attachments from Teams. A vulnerability in its redirect handling could allow attackers to bypass the configured allowlist of approved media hosts, potentially forcing the application to download content from untrusted sources and weakening security controls meant to prevent server-side request forgery attacks.
Technical details
The vulnerability is an SSRF bypass (CWE-918) in OpenClaw's MSTeams media download flow. Redirect chains were not consistently constrained to the configured mediaAllowHosts allowlist in specific attachment paths, allowing an attacker who can supply or influence attachment URLs to chain redirects through allowlisted hosts to non-allowlisted targets. The vulnerability affects versions through 2026.2.21-2 and is fixed in version 2026.2.22. No authentication or user interaction is required; the attack vector is network-based and relies on URL manipulation.
Affected products
- OpenClaw openclaw <=2026.2.21-2
Timeline
- 2026-03-03: disclosed: GHSA-w76h-8m22-hpgh published
- 2026-02-23: patched: Patch planned for version 2026.2.22