CVE-2026-34506 in OpenClaw

요약 (영어)

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.

책임이 있는

VulnCheck

예약하다

2026. 03. 30.

공개

2026. 03. 31.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
354354	OpenClaw Microsoft Teams Plugin channel 권한 상승	863	정의되지 않음	공식 수정	CVE-2026-34506