PT-2026-35553 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-02 · Updated 2026-04-28 · CVE-2026-41365

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A sender allowlist bypass exists in the MS Teams integration when fetching thread history via the Graph API. This allows attackers to retrieve thread messages that should be filtered by sender allowlists, effectively bypassing message filtering restrictions.

Recommendations Update to version 2026.3.31.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-441

Related Identifiers

CVE-2026-41365

GHSA-8PF2-VJ79-4WXG

GHSA-CHFM-XGC4-47RJ

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9 · Patch
• https://osv.dev/vulnerability/GHSA-8pf2-vj79-4wxg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-chfm-xgc4-47rj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41365 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://twitter.com/VulmonFeeds/status/2049078204254609676 · Twitter Post
• https://twitter.com/CVEarity/status/2049035650255790582 · Twitter Post
• https://t.me/CVEtracker/52007 · Telegram Post
• https://vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history · Note