PT-2026-35553 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-41365

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

Fix

Weakness Enumeration

CWE-441

Related Identifiers

CVE-2026-41365

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41365 · Security Note
• https://vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history · Note