CVE-2026-32037

MEDIUM

OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling

Title source: cna

Description

OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.

References (4)

[Third Party Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-w76h-8m22-hpgh

[Patch] https://github.com/openclaw/openclaw/commit/73d93dee64127a26f1acd09d0403b794cdeb4f5c

View Patch ZIP pw:eip

[Patch] https://github.com/openclaw/openclaw/commit/b34097f62df9d1960cc22600269cd3f3284e2124

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-redirect-chain-bypass-of-media-host-allowlist-in-msteams-attachment-handling

Scores

CVSS v3 6.0

EPSS 0.0004

EPSS Percentile 10.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE

CWE-918

Status published

Products (3)

npm/openclaw 0 - 2026.2.22npm

OpenClaw/OpenClaw < 2026.2.22

OpenClaw/OpenClaw 2026.2.22

Published Mar 19, 2026

Tracked Since Mar 20, 2026