PT-2026-37027 · Openclaw+1 · Openclaw+1

Keensecuritylab + 1 · Published 2026-04-17 · Updated 2026-05-05 · CVE-2026-43572

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.10 through 2026.4.13

Description The Microsoft Teams SSO invoke handler fails to apply sender allowlist checks. This allows attackers to bypass sender authorization by sending SSO invoke requests that are processed without proper validation, leading to unauthorized access to Teams SSO signin functionality.

Recommendations Update to version 2026.4.14 or newer.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-43572

GHSA-GC9R-867R-J85F

Affected Products

Teams

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gc9r-867r-j85f · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/80b1fa17bfc3f6a668492f0326ea52f48bb89776 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43572 · Security Note
• https://osv.dev/vulnerability/GHSA-gc9r-867r-j85f · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/66033 · Note
• https://vulncheck.com/advisories/openclaw-missing-sender-authorization-in-microsoft-teams-sso-invoke-handler · Note
• https://t.me/CVEtracker/52742 · Telegram Post