CVE-2026-62205: OpenClaw auth bypass

CISO Take

OpenClaw, a Python-based AI agent framework, shipped a missing-authorization flaw (CWE-862) in its MS Teams message actions feature between versions 2026.4.12-beta.1 and 2026.6.6: any caller reachable through that integration — including a lower-trust user or a chained input path — could trigger actions that should have required a stronger permission or policy check. The CVSS 7.1 (AC:L, PR:L, UI:N, I:H) means no user interaction is needed and the integrity impact is high, but the real-world blast radius hinges entirely on whether an operator actually exposed the Teams message actions feature and let untrusted input reach it. There's no EPSS data, no public exploit or Nuclei template, and it's not in CISA KEV, so this reads as a config-dependent risk rather than an imminent mass-exploitation threat. Teams sits at the trust boundary for many agentic deployments — messages from external or lower-privileged users routinely flow into agent action pipelines — so treat this as a priority patch for any OpenClaw deployment wired into Teams. Upgrade to 2026.6.6 immediately, and in the interim disable or gate the MS Teams message actions feature and audit logs for actions executed by accounts or message sources that shouldn't have had that authority.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High severity (CVSS 7.1) but conditional exploitability: the vulnerability requires the MS Teams message actions feature to be enabled and reachable by a lower-trust caller or input path, which is an operator configuration decision rather than a default-on exposure. No active exploitation evidence exists (not in CISA KEV, no EPSS score, no public PoC or Nuclei template), which lowers near-term urgency relative to a KEV-listed bug, but missing-authorization flaws in agent tool-invocation paths are historically easy to weaponize once reachability is confirmed, since no special skill beyond finding the reachable path is required (AC:L, PR:L, UI:N). Organizations that integrate OpenClaw agents with MS Teams for automation, ticketing, or notification workflows should treat this as high priority to patch even without confirmed in-the-wild exploitation.

How does the attack unfold?

Initial Access

A lower-trust caller or externally-reachable input path sends a message into the MS Teams channel monitored by the OpenClaw agent.

AML.T0084.002

Exploitation

The missing authorization check (CWE-862) on the MS Teams message actions feature lets the caller trigger actions that should have required stronger privilege or policy approval.

AML.T0053

Impact

Unauthorized actions execute within the Teams/agent workflow, compromising the integrity of agent-driven automation and any downstream process that trusted those actions as legitimate.

Initial Access

A lower-trust caller or externally-reachable input path sends a message into the MS Teams channel monitored by the OpenClaw agent.

AML.T0084.002

Exploitation

The missing authorization check (CWE-862) on the MS Teams message actions feature lets the caller trigger actions that should have required stronger privilege or policy approval.

AML.T0053

Impact

Unauthorized actions execute within the Teams/agent workflow, compromising the integrity of agent-driven automation and any downstream process that trusted those actions as legitimate.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

Patch to OpenClaw 2026.6.6 or later immediately. Until patched, disable the MS Teams message actions feature if it is not business-critical, or restrict it so only fully-trusted, authenticated callers can reach it — audit any configuration that routes external or lower-privileged Teams input into agent action paths. Review authorization/policy checks around all agent tool-invocation entry points, not just Teams, since CWE-862 (missing authorization) patterns often recur across similarly-structured integrations in the same codebase. Post-patch, monitor logs for actions executed via the Teams integration that originated from unexpected or lower-trust identities to catch pre-patch compromise or misconfiguration.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62205?

OpenClaw, a Python-based AI agent framework, shipped a missing-authorization flaw (CWE-862) in its MS Teams message actions feature between versions 2026.4.12-beta.1 and 2026.6.6: any caller reachable through that integration — including a lower-trust user or a chained input path — could trigger actions that should have required a stronger permission or policy check. The CVSS 7.1 (AC:L, PR:L, UI:N, I:H) means no user interaction is needed and the integrity impact is high, but the real-world blast radius hinges entirely on whether an operator actually exposed the Teams message actions feature and let untrusted input reach it. There's no EPSS data, no public exploit or Nuclei template, and it's not in CISA KEV, so this reads as a config-dependent risk rather than an imminent mass-exploitation threat. Teams sits at the trust boundary for many agentic deployments — messages from external or lower-privileged users routinely flow into agent action pipelines — so treat this as a priority patch for any OpenClaw deployment wired into Teams. Upgrade to 2026.6.6 immediately, and in the interim disable or gate the MS Teams message actions feature and audit logs for actions executed by accounts or message sources that shouldn't have had that authority.

Is CVE-2026-62205 actively exploited?

No confirmed active exploitation of CVE-2026-62205 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62205?

Patch to OpenClaw 2026.6.6 or later immediately. Until patched, disable the MS Teams message actions feature if it is not business-critical, or restrict it so only fully-trusted, authenticated callers can reach it — audit any configuration that routes external or lower-privileged Teams input into agent action paths. Review authorization/policy checks around all agent tool-invocation entry points, not just Teams, since CWE-862 (missing authorization) patterns often recur across similarly-structured integrations in the same codebase. Post-patch, monitor logs for actions executed via the Teams integration that originated from unexpected or lower-trust identities to catch pre-patch compromise or misconfiguration.

What systems are affected by CVE-2026-62205?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat/messaging integrations, workflow automation pipelines.

What is the CVSS score for CVE-2026-62205?

CVE-2026-62205 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat/messaging integrationsworkflow automation pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in 2026.6.6.

Exploitation Scenario

An OpenClaw-based support or ops agent is connected to a company's MS Teams tenant with the message actions feature enabled to let it triage tickets. A lower-trust guest account or an external user able to send messages into a monitored channel crafts a message that reaches the vulnerable action path; because the authorization check is missing, the agent executes the requested action (e.g., escalating, reassigning, or triggering a downstream automation) without verifying the caller had the required privilege. The attacker doesn't need valid elevated credentials or user interaction from a legitimate operator — only the ability to get a message into the reachable channel — turning a low-privilege chat presence into unauthorized control over agent-driven actions.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.