CVE-2026-62212: OpenClaw TOCTOU race bypasses Teams

CISO Take

OpenClaw's MS Teams integration relies on a safeFetch check that validates a destination isn't an internal address via DNS rebinding protection, but a race condition lets the DNS record change between that check and the actual connection, so a lower-trust caller can slip a request through that should have required stronger authorization. There's no public exploit, no Nuclei template, no EPSS score, and it isn't in CISA KEV, and the CVSS vector's AC:H reflects that winning the timing window reliably takes real effort — this isn't a script-kiddie bug. Still, the scope-changed, confidentiality-high rating (S:C/C:H) means a successful race could expose data beyond the vulnerable component itself, and blast radius depends entirely on whether the operator exposed the MS Teams feature to untrusted input in the first place. Upgrade to OpenClaw 2026.5.28 or later; until then, disable the MS Teams safeFetch path if it isn't essential, or front it with network-level egress controls that don't rely on a single DNS check. Detection-wise, watch for rapid DNS record changes or unusual internal-IP connection attempts correlated with MS Teams integration traffic.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Moderate-to-high theoretical severity (CVSS 7.1) tempered by high attack complexity — exploitation requires winning a precise timing window between DNS validation and use (classic TOCTOU/CWE-367), which is nontrivial over a network. No EPSS data, no KEV listing, no known public exploit or scanner template exist, so real-world exploitation likelihood currently appears low. However, the confidentiality-high, scope-changed rating means a successful race could leak data outside the vulnerable component's normal boundary. Risk should be treated as elevated specifically for operators who expose the MS Teams safeFetch feature to inputs from lower-trust callers or configured input paths — for those with the feature disabled or fully trusted-input-only, exposure is minimal.

How does the attack unfold?

Entry point

A lower-trust caller or configured input reaches the OpenClaw MS Teams integration's safeFetch validation path.

AML.T0053

Race the validation window

The attacker changes the DNS record for their controlled domain between the safeFetch DNS rebinding check and the actual connection use.

Bypass authorization check

OpenClaw treats the destination as already validated, skipping the stronger authorization/policy check the action should have required.

AML.T0107

Impact

The attacker-controlled request or action executes with elevated trust, risking confidentiality impact and unauthorized reach into resources beyond the vulnerable component.

Entry point

A lower-trust caller or configured input reaches the OpenClaw MS Teams integration's safeFetch validation path.

AML.T0053

Race the validation window

The attacker changes the DNS record for their controlled domain between the safeFetch DNS rebinding check and the actual connection use.

Bypass authorization check

OpenClaw treats the destination as already validated, skipping the stronger authorization/policy check the action should have required.

AML.T0107

Impact

The attacker-controlled request or action executes with elevated trust, risking confidentiality impact and unauthorized reach into resources beyond the vulnerable component.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

Upgrade OpenClaw to 2026.5.28 or later, which fixes the race condition per the GitHub Security Advisory (GHSA-wxm8-ghhq-q688) and VulnCheck advisory. If immediate patching isn't possible, disable or restrict the MS Teams safeFetch-dependent feature, especially where lower-trust or externally configured input can reach it. Apply defense-in-depth network egress controls (e.g., enforce destination allowlists at the network/proxy layer rather than relying solely on application-level DNS checks) so a single TOCTOU bypass doesn't translate into internal network access. For detection, monitor for anomalous rapid DNS resolution changes tied to outbound requests from the OpenClaw host, and audit logs for MS Teams integration calls that resolve to internal/private IP ranges.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62212?

OpenClaw's MS Teams integration relies on a safeFetch check that validates a destination isn't an internal address via DNS rebinding protection, but a race condition lets the DNS record change between that check and the actual connection, so a lower-trust caller can slip a request through that should have required stronger authorization. There's no public exploit, no Nuclei template, no EPSS score, and it isn't in CISA KEV, and the CVSS vector's AC:H reflects that winning the timing window reliably takes real effort — this isn't a script-kiddie bug. Still, the scope-changed, confidentiality-high rating (S:C/C:H) means a successful race could expose data beyond the vulnerable component itself, and blast radius depends entirely on whether the operator exposed the MS Teams feature to untrusted input in the first place. Upgrade to OpenClaw 2026.5.28 or later; until then, disable the MS Teams safeFetch path if it isn't essential, or front it with network-level egress controls that don't rely on a single DNS check. Detection-wise, watch for rapid DNS record changes or unusual internal-IP connection attempts correlated with MS Teams integration traffic.

Is CVE-2026-62212 actively exploited?

No confirmed active exploitation of CVE-2026-62212 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62212?

Upgrade OpenClaw to 2026.5.28 or later, which fixes the race condition per the GitHub Security Advisory (GHSA-wxm8-ghhq-q688) and VulnCheck advisory. If immediate patching isn't possible, disable or restrict the MS Teams safeFetch-dependent feature, especially where lower-trust or externally configured input can reach it. Apply defense-in-depth network egress controls (e.g., enforce destination allowlists at the network/proxy layer rather than relying solely on application-level DNS checks) so a single TOCTOU bypass doesn't translate into internal network access. For detection, monitor for anomalous rapid DNS resolution changes tied to outbound requests from the OpenClaw host, and audit logs for MS Teams integration calls that resolve to internal/private IP ranges.

What systems are affected by CVE-2026-62212?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integrations, SSRF-guarded fetch utilities.

What is the CVSS score for CVE-2026-62212?

CVE-2026-62212 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool integrationsSSRF-guarded fetch utilities

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Exploitation Scenario

An attacker who can influence input reaching OpenClaw's MS Teams integration (either as a lower-trust caller or via a configured input path) sets up a domain they control with a DNS TTL and record they can flip on demand. They trigger the safeFetch validation, which resolves the domain to a benign public IP and passes the DNS rebinding check; immediately after the check completes but before the actual connection is made, the attacker rebinds the domain's DNS record to an internal/private address. Because of the race window, OpenClaw proceeds to fetch the now-internal target as if it had passed validation, allowing the agent to perform an action or reach a resource that should have required a stronger authorization or policy check — with attack complexity high because winning this timing window reliably requires careful engineering.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.