CVE-2026-62213: OpenClaw Teams outbound leaks Bot

CISO Take

OpenClaw versions before 2026.5.27 leak Bot Framework tokens through MS Teams outbound requests, letting a lower-trust caller reach a configured input path and pull credentials that should stay inside the trusted boundary. This is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) that requires low privileges but no user interaction, so it matters most in multi-tenant or multi-team OpenClaw deployments where not every caller should be equally trusted. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template available, so mass exploitation pressure is currently low, but a leaked Bot Framework token can be replayed to impersonate the bot across Teams once obtained. Patch to OpenClaw 2026.5.27 or later immediately; until then, restrict which principals can reach the affected input paths, rotate any Bot Framework tokens that may have transited the vulnerable code path, and monitor Teams audit logs for anomalous bot-identity activity.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.5) driven entirely by confidentiality impact — no integrity or availability loss. The attack is network-reachable with low complexity and no user interaction, but requires the attacker to already hold low privileges and access to a configured input path, meaning this is primarily an insider or lateral-movement risk rather than an unauthenticated internet-facing one. Absence from CISA KEV, no EPSS score, and no known public exploit or scanner template all point to low near-term exploitation likelihood, but the underlying flaw (CWE-522, insufficiently protected credentials) is trivial to exploit once the input path is reachable, so risk rises sharply in any deployment where OpenClaw serves multiple tenants, teams, or trust levels.

How does the attack unfold?

Initial Access

A lower-trust caller with access to a configured input path within the OpenClaw deployment interacts with the agent.

AML.T0084

Exploitation

The caller triggers the vulnerable MS Teams outbound request handling, causing the Bot Framework token to be exposed instead of staying server-side.

AML.T0083

Credential Theft

The attacker captures the exposed Bot Framework token for later reuse.

AML.T0055

Impact

The attacker replays the stolen token to impersonate the bot in Microsoft Teams, sending messages or reading content as the trusted integration.

AML.T0091.000

Initial Access

A lower-trust caller with access to a configured input path within the OpenClaw deployment interacts with the agent.

AML.T0084

Exploitation

The caller triggers the vulnerable MS Teams outbound request handling, causing the Bot Framework token to be exposed instead of staying server-side.

AML.T0083

Credential Theft

The attacker captures the exposed Bot Framework token for later reuse.

AML.T0055

Impact

The attacker replays the stolen token to impersonate the bot in Microsoft Teams, sending messages or reading content as the trusted integration.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade OpenClaw to 2026.5.27 or later, which fixes the outbound request handling that exposes the token. 2) Rotate all Bot Framework tokens/app credentials used by OpenClaw's Teams integration, since any token that transited a vulnerable version should be considered potentially exposed. 3) Until patched, restrict which internal callers/roles can reach the configured input paths that trigger MS Teams outbound requests (principle of least privilege on agent tool invocation). 4) Audit MS Teams bot activity logs for message sends or actions outside expected patterns that could indicate token replay. 5) Store Bot Framework credentials in a secrets manager with short-lived tokens where Microsoft's Bot Framework supports it, reducing the blast radius of any future leak.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Agent Plugin AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-62213?

OpenClaw versions before 2026.5.27 leak Bot Framework tokens through MS Teams outbound requests, letting a lower-trust caller reach a configured input path and pull credentials that should stay inside the trusted boundary. This is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) that requires low privileges but no user interaction, so it matters most in multi-tenant or multi-team OpenClaw deployments where not every caller should be equally trusted. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template available, so mass exploitation pressure is currently low, but a leaked Bot Framework token can be replayed to impersonate the bot across Teams once obtained. Patch to OpenClaw 2026.5.27 or later immediately; until then, restrict which principals can reach the affected input paths, rotate any Bot Framework tokens that may have transited the vulnerable code path, and monitor Teams audit logs for anomalous bot-identity activity.

Is CVE-2026-62213 actively exploited?

No confirmed active exploitation of CVE-2026-62213 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62213?

1) Upgrade OpenClaw to 2026.5.27 or later, which fixes the outbound request handling that exposes the token. 2) Rotate all Bot Framework tokens/app credentials used by OpenClaw's Teams integration, since any token that transited a vulnerable version should be considered potentially exposed. 3) Until patched, restrict which internal callers/roles can reach the configured input paths that trigger MS Teams outbound requests (principle of least privilege on agent tool invocation). 4) Audit MS Teams bot activity logs for message sends or actions outside expected patterns that could indicate token replay. 5) Store Bot Framework credentials in a secrets manager with short-lived tokens where Microsoft's Bot Framework supports it, reducing the blast radius of any future leak.

What systems are affected by CVE-2026-62213?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integrations, enterprise chat/notification connectors.

What is the CVSS score for CVE-2026-62213?

CVE-2026-62213 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool integrationsenterprise chat/notification connectors

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.

Exploitation Scenario

An attacker who already holds a low-privilege account or role within an organization's OpenClaw deployment (e.g., a lower-trust user, a compromised service account, or a malicious internal actor) submits input through a configured path that the agent forwards as part of an MS Teams outbound request. Due to the flaw, the Bot Framework token used to authenticate that outbound call is exposed to the caller instead of remaining server-side. The attacker captures the token and replays it directly against the Bot Framework API, allowing them to send messages or perform bot actions in Microsoft Teams channels as the trusted bot identity — enabling social engineering, data harvesting from channels the bot can read, or further lateral movement using the bot's trusted position.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials Primary CWE-522 Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.