Openclaw · Openclaw · CVE-2026-34509
**Name of the Vulnerable Software and Affected Versions**
OpenClaw versions prior to 2026.3.8
**Description**
The software contains a sender allowlist bypass in its Microsoft Teams plugin. This allows unauthorized senders to bypass intended authorization checks. Specifically, when a team/channel route allowlist is configured with an empty `groupAllowFrom` parameter, the message handler creates wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.
**Recommendations**
Update to version 2026.3.8 or later.