Executive brief
OpenClaw, an open-source tool often used for gateway and integration services, contains a security flaw in its Microsoft Teams integration. An attacker with low-level access could bypass security checks to access sensitive internal data or perform unauthorized actions. This occurs because the system's security validation can be tricked during a brief timing window, potentially leading to unauthorized data exposure depending on how the software is configured.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in OpenClaw's 'safeFetch' feature used for MS Teams integrations. The vulnerability (CWE-367) occurs because the DNS rebinding validation check and the subsequent resource fetch do not happen atomically. A network-based attacker with low privileges can exploit this timing window to bypass DNS rebinding protections, potentially leading to Server-Side Request Forgery (SSRF) or unauthorized policy elevation. The attack complexity is high as it requires winning a specific timing window. The issue is resolved in version 2026.5.28.
Affected products
- OpenClaw OpenClaw < 2026.5.28
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: VulnCheck advisory published
- 2026-07-17: advisory: NVD record published