CVE-2026-34506: OpenClaw auth bypass lets any Teams

CISO Take

OpenClaw's Microsoft Teams plugin contains an authorization bypass (CWE-863) where leaving the `groupAllowFrom` allowlist parameter empty causes the message handler to synthesize wildcard sender authorization instead of rejecting the request — any authenticated Teams user in the matched channel can trigger the AI agent as if allowlisted. Although CVSS rates this medium (4.3), the EPSS percentile places it in the top 82% for exploitation likelihood, and the attack requires only a low-privileged Teams account with no user interaction, making it trivial to abuse in misconfigured enterprise deployments. The blast radius scales with what the agent is authorized to do: in deployments where OpenClaw has access to internal knowledge bases, document retrieval, or automated workflows, an unauthorized invocation becomes a lateral movement vector. Upgrade to OpenClaw 2026.3.8 immediately; as a workaround, audit every route allowlist configuration and ensure no `groupAllowFrom` field is left empty.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Medium CVSS but elevated operational risk. The empty-parameter misconfiguration produces no visible error at setup time, meaning vulnerable configurations may be widespread in existing deployments without operator awareness. With AC:L/PR:L/UI:N, any credentialed Teams user can trigger exploitation without specialized skill or tooling. Risk scales directly with the agent's configured tool set — an OpenClaw instance connected to internal data repositories or capable of executing code represents a materially higher impact than CVSS 4.3 suggests for those environments.

How does the attack unfold?

Initial Access

Attacker uses a legitimate low-privileged Teams account to gain presence in a channel where an OpenClaw AI agent route is active.

AML.T0012

Trigger Discovery

Attacker sends a test message and observes the agent responds — confirming the route allowlist has an empty `groupAllowFrom`, producing wildcard authorization.

AML.T0084.002

Authorization Bypass

Attacker sends crafted requests to the Teams channel; the OpenClaw handler synthesizes wildcard sender authorization and processes them as if the sender is explicitly allowlisted.

AML.T0053

Unauthorized Agent Invocation

Agent executes its configured tools on behalf of the unauthorized sender — querying internal data sources, triggering automated workflows, or accessing restricted resources — with no authorization alerts raised.

AML.T0053

Initial Access

Attacker uses a legitimate low-privileged Teams account to gain presence in a channel where an OpenClaw AI agent route is active.

AML.T0012

Trigger Discovery

Attacker sends a test message and observes the agent responds — confirming the route allowlist has an empty `groupAllowFrom`, producing wildcard authorization.

AML.T0084.002

Authorization Bypass

Attacker sends crafted requests to the Teams channel; the OpenClaw handler synthesizes wildcard sender authorization and processes them as if the sender is explicitly allowlisted.

AML.T0053

Unauthorized Agent Invocation

Agent executes its configured tools on behalf of the unauthorized sender — querying internal data sources, triggering automated workflows, or accessing restricted resources — with no authorization alerts raised.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

4 steps

Patch: Upgrade to OpenClaw 2026.3.8 or later — the fix is available in the referenced commit (88aee91).
Workaround: Immediately audit all Teams route allowlist configurations; populate every groupAllowFrom field with explicit sender identifiers or disable the route until patched.
Detection: Review OpenClaw agent logs for messages processed from senders not in the intended allowlist on any Teams route — unexpected responder activity is the primary indicator.
Access hardening: Restrict Teams channel membership on channels with active OpenClaw routes to vetted users only, reducing the pool of potential unauthorized senders even before patching.

How is it classified?

Auth Bypass Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms to manage AI risks are in place

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-34506?

OpenClaw's Microsoft Teams plugin contains an authorization bypass (CWE-863) where leaving the `groupAllowFrom` allowlist parameter empty causes the message handler to synthesize wildcard sender authorization instead of rejecting the request — any authenticated Teams user in the matched channel can trigger the AI agent as if allowlisted. Although CVSS rates this medium (4.3), the EPSS percentile places it in the top 82% for exploitation likelihood, and the attack requires only a low-privileged Teams account with no user interaction, making it trivial to abuse in misconfigured enterprise deployments. The blast radius scales with what the agent is authorized to do: in deployments where OpenClaw has access to internal knowledge bases, document retrieval, or automated workflows, an unauthorized invocation becomes a lateral movement vector. Upgrade to OpenClaw 2026.3.8 immediately; as a workaround, audit every route allowlist configuration and ensure no `groupAllowFrom` field is left empty.

Is CVE-2026-34506 actively exploited?

No confirmed active exploitation of CVE-2026-34506 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34506?

1. Patch: Upgrade to OpenClaw 2026.3.8 or later — the fix is available in the referenced commit (88aee91). 2. Workaround: Immediately audit all Teams route allowlist configurations; populate every `groupAllowFrom` field with explicit sender identifiers or disable the route until patched. 3. Detection: Review OpenClaw agent logs for messages processed from senders not in the intended allowlist on any Teams route — unexpected responder activity is the primary indicator. 4. Access hardening: Restrict Teams channel membership on channels with active OpenClaw routes to vetted users only, reducing the pool of potential unauthorized senders even before patching.

What systems are affected by CVE-2026-34506?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, enterprise AI assistants, collaboration platform integrations.

What is the CVSS score for CVE-2026-34506?

CVE-2026-34506 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksenterprise AI assistantscollaboration platform integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: 6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.

Exploitation Scenario

An attacker holding a legitimate but low-privileged Teams account (a contractor, an intern, or a compromised account) is a member of a channel where OpenClaw is deployed as a corporate AI agent. The attacker observes that the agent responds to their messages — a signal that `groupAllowFrom` is empty in the route allowlist. The attacker then sends crafted natural-language requests to invoke the agent's configured tools: querying internal HR or engineering document repositories, triggering automated code review or ticketing workflows, or extracting summaries of sensitive content. Because the agent processes the requests as authorized, no authorization alerts fire and the activity is indistinguishable from legitimate usage in audit logs.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.