Executive brief
OpenClaw's Bot Framework, used for building and connecting automated bots to platforms like Microsoft Teams, contains a security flaw in how it handles service URLs. An attacker with low-level access can provide a malicious URL to trick the system into sending sensitive bot tokens and login credentials to an external server. This could lead to the unauthorized takeover of automated bots and the exposure of private communication channels.
Technical details
An improper input validation vulnerability exists in OpenClaw versions prior to 2026.5.28 within the Bot Framework (specifically the msteams package). The root cause is a failure to properly validate the 'serviceUrl' parameter provided by callers. A network-based attacker with low privileges can supply a malicious serviceUrl, causing the framework to transmit sensitive authentication data, including bot tokens and credentials, to an attacker-controlled endpoint. This is characterized as a Server-Side Request Forgery (SSRF) variant leading to credential exposure (CWE-522). The issue is resolved in version 2026.5.28.
Affected products
- OpenClaw msteams (Bot Framework) < 2026.5.28
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD and VulnCheck published details
- 2026-05-28: patched: First stable patched version released