CVE-2026-34506: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-34506 is a sender allowlist bypass vulnerability in OpenClaw's Microsoft Teams plugin that allows low-privileged, unauthorized senders to bypass intended authorization checks. It affects OpenClaw versions prior to 2026.3.8 (npm package). When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes. The vulnerability was published on March 31, 2026, with a patch released in version 2026.3.8. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, OpenClaw Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) — the message handler in extensions/msteams/src/monitor-handler/message-handler.ts incorrectly synthesized a wildcard ("*") value for groupAllowFrom when a route allowlist entry matched but effectiveGroupAllowFrom was empty and channelGate.allowlistConfigured was true. This logic flaw caused the groupPolicy: "allowlist" sender check to be effectively bypassed for any sender present in the matched team/channel. The fix (commit 88aee91) removes the conditional wildcard synthesis, passing effectiveGroupAllowFrom directly to evaluateSenderGroupAccessForPolicy regardless of route allowlist configuration (OpenClaw Advisory, Fix Commit). The vulnerability is only exploitable when a team/channel route allowlist is configured alongside an empty sender allowlist (groupAllowFrom: []); default unauthenticated access is not affected.

Successful exploitation allows any low-privileged sender within a matched Microsoft Teams team/channel to bypass the groupPolicy: "allowlist" authorization boundary and trigger replies in allowlisted Teams routes. The primary impact is a limited confidentiality exposure — unauthorized senders may receive bot replies containing information intended only for allowlisted users. There is no integrity or availability impact, and the vulnerability does not affect systems or channels not using the route allowlist feature (OpenClaw Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (membership in the targeted Teams team/channel) and a specific misconfiguration (route allowlist configured with empty groupAllowFrom), limiting the practical attack surface (Github Advisory, OpenClaw Advisory).

1. Identify target: Determine that the target OpenClaw deployment uses the Microsoft Teams plugin with a version ≤ 2026.3.7 and has a team/channel route allowlist configured.
2. Confirm misconfiguration: Verify that the groupAllowFrom parameter in the route allowlist configuration is empty (groupAllowFrom: []) while groupPolicy: "allowlist" is set — this is the precondition for the bypass.
3. Obtain Teams membership: Gain or already possess low-privileged membership (any user account) in the targeted Microsoft Teams team/channel covered by the route allowlist.
4. Send a message: Send a message to the allowlisted team/channel from the unauthorized account. Because the message handler synthesizes wildcard sender authorization when groupAllowFrom is empty and a route allowlist matches, the sender check is bypassed.
5. Receive unauthorized reply: The OpenClaw bot processes the message and triggers a reply as if the sender were authorized, potentially exposing information intended only for allowlisted senders (OpenClaw Advisory, Fix Commit).

• Logs: OpenClaw application logs showing bot replies sent to senders not present in the configured groupAllowFrom list for a given Teams route; unexpected conversationStore.upsert calls associated with unauthorized sender IDs.
• Network: Bot activity originating from team/channel conversations where the sender's AAD object ID (aadObjectId) does not match any entry in the configured sender allowlist.
• Configuration Audit: Presence of Teams route allowlist entries (teams.<teamId>.channels) in OpenClaw configuration alongside an empty groupAllowFrom: [] field under channels.msteams — this combination indicates a vulnerable configuration (OpenClaw Advisory).

Upgrade OpenClaw (npm package) to version 2026.3.8 or later, which contains the fix in commit 88aee91 that removes the wildcard sender synthesis logic. As an interim workaround, ensure that any team/channel route allowlist configuration includes a non-empty groupAllowFrom parameter to prevent the bypass condition from being triggered. Administrators should audit all OpenClaw Teams plugin configurations for instances where groupAllowFrom is empty while a route allowlist is active (OpenClaw Advisory, Fix Commit).

The vulnerability was reported by security researcher @zpbrent and acknowledged by the OpenClaw maintainer (steipete) in the official GitHub security advisory. The advisory was initially published as a duplicate (GHSA-xg59-f45v-9r9j) and subsequently withdrawn on April 6, 2026, with the canonical advisory being GHSA-g7cr-9h7q-4qxq. No significant broader media coverage or notable community discussion beyond standard vulnerability aggregator indexing has been observed (OpenClaw Advisory, Github Advisory).