EUVD-2026-45102
GHSA-24g4-9847-8c6x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P prerequisite maps to AC:H in 3.1; PR:L reflects required lower-trust caller authentication; impact is confidentiality-only with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.
AnalysisAI
Bot token and credential exposure in OpenClaw Bot Framework (versions before 2026.5.28) enables low-privilege authenticated callers to exfiltrate sensitive authentication data by supplying crafted serviceUrl values that circumvent trusted boundary validation. The flaw resides in the Microsoft Teams integration component (openclaw:msteams) and allows attackers to redirect credential-bearing requests to attacker-controlled endpoints, compromising bot tokens and downstream authentication secrets. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.0 reflects high confidentiality impact contingent on a specific attack prerequisite (AT:P) and low-privilege access.
Technical ContextAI
OpenClaw Bot Framework's Microsoft Teams integration component (CPE: cpe:2.3:a:openclaw:msteams) implements service URL routing to direct bot communications to authorized endpoints. The root cause is CWE-522 (Insufficiently Protected Credentials): the framework fails to properly validate the serviceUrl parameter before issuing credential-bearing requests, allowing that parameter to be supplied by lower-trust callers through configured input paths. The vulnerability is architecturally analogous to SSRF-driven credential theft - the attacker does not forge server-side requests per se, but manipulates the destination URL to which the framework will forward bot tokens and authentication credentials. The trusted boundary is the demarcation between internal, validated Microsoft Teams service URLs and arbitrary external URLs; the missing validation collapses that boundary when a lower-trust caller is permitted to supply a serviceUrl value.
RemediationAI
Upgrade OpenClaw to version 2026.5.28 or later, which introduces proper serviceUrl parameter validation. The vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-prwc-c6w5-mmgr documents the fix. If immediate patching is not possible, restrict which principals are permitted to supply serviceUrl values - enforce an allowlist of approved Microsoft Teams service URL prefixes at the application layer or API gateway level, blocking arbitrary external URLs. Additionally, limit caller permissions so that lower-trust bot users cannot reach the input paths that accept serviceUrl parameters; reducing the set of principals who can trigger this code path eliminates exposure without disabling functionality for trusted callers. VulnCheck's advisory at https://www.vulncheck.com/advisories/openclaw-bot-framework-ssrf-via-serviceurl-parameter-validation provides supplementary technical context. Rotate any bot tokens or credentials that may have been exposed prior to patching, particularly if lower-trust callers had recent access to affected input paths.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today