CVE-2026-32037CWE-918

OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling

Low · published March 19, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-19T22:07Z
EPSS history
Timeline
  • 19 MAR 22:07Z
    OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling
    cvelistv5