MEDIUM
OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching
Published Mar 5, 2026
5.9
MEDIUMCVSS 4.0
EPSS 0.47%
Description
OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be enabled) that leaks bearer tokens to allowlisted suffix domains. When retrying downloads after receiving 401 or 403 responses, the application sends Authorization bearer tokens to untrusted hosts matching the permissive suffix-based allowlist, enabling token theft.
Affected products
-
- Version 0StatusaffectedConstraints<=2026.1.30
- Version 2026.2.1StatusunaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
openclaw
npm
Introduced 0 Fixed 2026.2.1
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | openclaw | 0 | 2026.2.1 |
Remediation
No remediation recorded yet.
Weaknesses (1)
References (7)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9927 Advisory
- https://github.com/advisories/GHSA-7vwx-582j-j332 Advisory
- https://github.com/openclaw/openclaw/commit/41cc5bcd4f1d434ad1bbdfa55b56f25025ecbf6b patch
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.1
- https://github.com/openclaw/openclaw/security/advisories/GHSA-7vwx-582j-j332 vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-28481
- https://www.vulncheck.com/advisories/openclaw-bearer-token-leakage-via-ms-teams-attachment-downloader-suffix-matching third-party-advisoryThird Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Mar 5, 2026
Updated May 25, 2026
Reserved Feb 27, 2026
Link CVE-2026-28481
CISA Vulnrichment
Updated Mar 9, 2026
ENISA EUVD
EUVD-2026-9927 GHSA-7VWX-582J-J332 Assigner VulnCheck
Published Mar 5, 2026
Updated May 25, 2026
Exploited since n/a
Link EUVD-2026-9927