CVE-2026-32037

MEDIUM

OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling

Title source: cna
STIX 2.1

Description

OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-w76h-8m22-hpgh)
https://github.com/openclaw/openclaw/security/advisories/GHSA-w76h-8m22-hpgh
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling
https://www.vulncheck.com/advisories/openclaw-redirect-chain-bypass-of-media-host-allowlist-in-msteams-attachment-handling

Scores

CVSS v3 6.0
EPSS 0.0017
EPSS Percentile 6.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (3)
npm/openclaw 0 - 2026.2.22npm
OpenClaw/OpenClaw < 2026.2.22
OpenClaw/OpenClaw 2026.2.22
Published Mar 19, 2026
Tracked Since Mar 20, 2026