UNKNOWN npm
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API
GHSA-chfm-xgc4-47rj · CVE-2026-41365
Published · Modified
Description
Summary
MSTeams thread history bypasses sender allowlist via Graph API
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28 MS Teams because Graph-fetched thread history bypasses sender allowlists, with unreleased mainline filtering fix.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
5cca38084074fb5095aa11b6a59820d63e4937c9— 2026-03-30T15:38:26+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
References
- WEB https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41365
- WEB https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9
- PACKAGE https://github.com/openclaw/openclaw
- WEB https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- WEB https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history
Ready to move
Start Securing
Free, no credit card | First findings in minutes