PT-2026-31965 · Openclaw+1 · Openclaw+1

Peng Zhou · Published 2026-03-29 · Updated 2026-04-10 · CVE-2026-35654

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description Microsoft Teams feedback invokes previously bypassed sender authorization, potentially allowing unauthorized senders to record session feedback or trigger reflection. The issue stemmed from a bypass of sender allowlist checks via feedback invoke endpoints. A commit, c5415a474bb085404c20f8b312e436997977b1ea, implemented DM and group authorization checks to address this.

Recommendations Update to version 2026.3.25 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization

Weakness Enumeration

CWE-288

CWE-863

Related Identifiers

CVE-2026-35654

GHSA-RF6H-5GPW-QRGQ

Affected Products

Teams

Openclaw

References · 7

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rf6h-5gpw-qrgq · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/c5415a474bb085404c20f8b312e436997977b1ea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35654 · Security Note
• https://osv.dev/vulnerability/GHSA-rf6h-5gpw-qrgq · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-microsoft-teams-feedback-invoke · Note
• https://twitter.com/CVEnew/status/2042710260150878383 · Twitter Post