CVE-2026-41365 - OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

Back Back to CVE browser

MEDIUM

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

Published Apr 27, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.31%

Description

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
Affected
- ≥ 0, < 2026.3.31
Unaffected
- 2026.3.31

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
OpenClaw	OpenClaw	unaffected	Affected ≥ 0, < 2026.3.31 Unaffected 2026.3.31

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.3.31

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-441

CWE-863

Incorrect Authorization

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25945
Advisory
https://github.com/advisories/GHSA-chfm-xgc4-47rj
Advisory
https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9
patch
https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41365
https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25945		Advisory
https://github.com/advisories/GHSA-chfm-xgc4-47rj		Advisory
https://github.com/openclaw/openclaw/commit/5cca38084074fb5095aa11b6a59820d63e4937c9		patch
https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41365
https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-graph-api-thread-history		third-party-advisoryThird Party Advisory