CVE-2026-41365

MEDIUM

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-chfm-xgc4-47rj)
https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History
https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history

Scores

CVSS v3 5.4
EPSS 0.0018
EPSS Percentile 7.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-441
Status published
Products (4)
npm/openclaw 0 - 2026.3.31npm
OpenClaw/OpenClaw < 2026.3.31
openclaw/openclaw < 2026.3.31
OpenClaw/OpenClaw 2026.3.31
Published Apr 28, 2026
Tracked Since Apr 28, 2026