CVE-2026-62224: OpenClaw MS Teams auth bypass

CISO Take

OpenClaw's MS Teams integration lets a lower-privileged user perform actions requiring stronger authorization simply by renaming their Teams display name to match an entry in the agent's allowFrom list, because that control keys off a mutable identity field instead of a stable identifier. There is no CISA KEV listing, no published EPSS score, no public exploit, and no Nuclei scanner template for this CVE, so there's no evidence of active exploitation yet — but the attack itself requires no AI/ML expertise or special tooling, just a display-name change, which keeps the practical exploitation bar very low despite the medium CVSS 5.4 rating. Any organization running OpenClaw's MS Teams bot in a shared workspace and relying on allowFrom to gate privileged agent actions (approvals, admin commands, sensitive tool invocations) is exposed to insider or low-trust-account escalation. Upgrade to OpenClaw MS Teams 2026.5.12 or later immediately; until patched, treat allowFrom as untrusted and bind authorization checks to Teams' immutable user identifier (AAD object ID / UPN) instead of display name, and audit logs for privileged agent actions preceded by a recent display-name change.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Medium severity (CVSS 5.4) but low exploitation complexity: attack vector is network, attack complexity low, only low privileges required, and no user interaction needed from the victim. The confidentiality and integrity impact are limited (C:L/I:L, no availability impact), which caps the CVSS score, but the real-world risk is understated by the score because the vulnerability enables authorization escalation within an agentic system — a class of flaw that MITRE ATLAS and OWASP both flag as high-consequence in agent deployments even when the CVSS metrics look moderate. No KEV listing, no EPSS score, and no public PoC currently exist, so opportunistic mass exploitation is unlikely in the near term; the greater risk is targeted insider abuse or lateral escalation within an organization that already grants some employees Teams access to the OpenClaw bot.

How does the attack unfold?

Initial Access

Attacker holds legitimate but low-trust access to a MS Teams workspace/channel where the OpenClaw bot is deployed.

Identity Spoofing

Attacker changes their Teams display name to match that of a user with stronger authorization listed in the bot's allowFrom configuration.

AML.T0073

Authorization Bypass

OpenClaw's allowFrom check matches on the mutable display name and incorrectly grants the attacker elevated trust.

AML.T0053

Impact

Attacker triggers privileged agent actions or tool invocations that should have required the impersonated user's authorization.

AML.T0053

Initial Access

Attacker holds legitimate but low-trust access to a MS Teams workspace/channel where the OpenClaw bot is deployed.

Identity Spoofing

Attacker changes their Teams display name to match that of a user with stronger authorization listed in the bot's allowFrom configuration.

AML.T0073

Authorization Bypass

OpenClaw's allowFrom check matches on the mutable display name and incorrectly grants the attacker elevated trust.

AML.T0053

Impact

Attacker triggers privileged agent actions or tool invocations that should have required the impersonated user's authorization.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

1) Upgrade OpenClaw MS Teams to version 2026.5.12 or later, which fixes the mutable-display-name binding. 2) Until patched, do not rely on allowFrom for security-critical authorization decisions; if possible, disable or restrict the feature, or front it with an additional identity check keyed on Teams' immutable AAD object ID/UPN. 3) Audit MS Teams admin logs for recent display-name changes correlated with privileged agent actions, which would indicate attempted or successful exploitation. 4) Review OpenClaw configuration to confirm which agent actions are gated by allowFrom and reduce the privileged action surface exposed to it where feasible.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0073 - Impersonation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62224?

OpenClaw's MS Teams integration lets a lower-privileged user perform actions requiring stronger authorization simply by renaming their Teams display name to match an entry in the agent's allowFrom list, because that control keys off a mutable identity field instead of a stable identifier. There is no CISA KEV listing, no published EPSS score, no public exploit, and no Nuclei scanner template for this CVE, so there's no evidence of active exploitation yet — but the attack itself requires no AI/ML expertise or special tooling, just a display-name change, which keeps the practical exploitation bar very low despite the medium CVSS 5.4 rating. Any organization running OpenClaw's MS Teams bot in a shared workspace and relying on allowFrom to gate privileged agent actions (approvals, admin commands, sensitive tool invocations) is exposed to insider or low-trust-account escalation. Upgrade to OpenClaw MS Teams 2026.5.12 or later immediately; until patched, treat allowFrom as untrusted and bind authorization checks to Teams' immutable user identifier (AAD object ID / UPN) instead of display name, and audit logs for privileged agent actions preceded by a recent display-name change.

Is CVE-2026-62224 actively exploited?

No confirmed active exploitation of CVE-2026-62224 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62224?

1) Upgrade OpenClaw MS Teams to version 2026.5.12 or later, which fixes the mutable-display-name binding. 2) Until patched, do not rely on allowFrom for security-critical authorization decisions; if possible, disable or restrict the feature, or front it with an additional identity check keyed on Teams' immutable AAD object ID/UPN. 3) Audit MS Teams admin logs for recent display-name changes correlated with privileged agent actions, which would indicate attempted or successful exploitation. 4) Review OpenClaw configuration to confirm which agent actions are gated by allowFrom and reduce the privileged action surface exposed to it where feasible.

What systems are affected by CVE-2026-62224?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat platform agent integrations.

What is the CVSS score for CVE-2026-62224?

CVE-2026-62224 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat platform agent integrations

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0073 Impersonation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

Exploitation Scenario

A contractor or junior employee with legitimate but low-trust access to a Teams channel where the OpenClaw bot operates renames their Teams display name to match that of an IT admin or approver listed in the bot's allowFrom configuration. They then message the bot requesting a privileged action (e.g., approving a workflow, pulling sensitive data, or triggering an administrative tool call) that would normally require the admin's authorization. Because OpenClaw matches on the spoofed display name rather than a verified user ID, the bot treats the request as coming from the trusted identity and executes the privileged action on the attacker's behalf.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing Primary CWE-863 Incorrect Authorization Primary CWE-290 Authentication Bypass by Spoofing CWE-863 Incorrect Authorization

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.