Vulnerability Description
OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | >= 2026.4.10, < 2026.4.14 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/80b1fa17bfc3f6a668492f0326ea52f48bb8Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gc9r-867r-j85fVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-missing-sender-authorization-in-miThird Party Advisory
FAQ
What is CVE-2026-43572?
CVE-2026-43572 is a vulnerability with a CVSS score of 5.3 (MEDIUM). OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass s...
How severe is CVE-2026-43572?
CVE-2026-43572 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43572?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.