CVE-2026-41365CWE-441

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

Medium · published April 27, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2026-04-27T23:24Z
EPSS history
Timeline
  • 27 APR 23:24Z
    OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History
    cvelistv5