N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7qf6-h84j-8fq4

GHSA-7qf6-h84j-8fq4: OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model

Impact

Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops.

Affected Packages / Versions

Package: openclaw (npm)
Latest published vulnerable version: 2026.2.25
Affected range: <= 2026.2.25
Planned patched version for next release: 2026.2.26

Technical Details

The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DNS + policy checks. This could allow policy drift and SSRF boundary inconsistency between channel/plugin paths.

The fix unifies this path by:

routing Microsoft Teams Graph message/hosted-content/attachment fetches through shared SSRF-guarded fetch paths,
routing auth-scope fallback attachment downloads through the same guarded policy model,
centralizing hostname-suffix allowlist policy helpers in plugin-sdk so channel/plugins use the same allowlist normalization and policy construction behavior.

Fix Commit(s)

57334cd7d85174d5f951de01114fd5801b063564

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7qf6-h84j-8fq4

GHSA-7qf6-h84j-8fq4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.25	2026.2.26

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from an inconsistent and decentralized approach to preventing Server-Side Request Forgery (SSRF) within the Microsoft Teams media fetching functionality of the openclaw package. The code utilized a mix of direct network calls (fetch) and a custom, plugin-local safeFetch function for security. This safeFetch function, along with its callers like fetchWithAuthFallback, was intended to validate requests but was not uniformly applied, allowing certain code paths to bypass these protections entirely. For instance, fetchGraphCollection and parts of downloadMSTeamsGraphMedia made direct network requests without proper validation.

The security patch addresses this by removing the localized and flawed safeFetch implementation and refactoring the code to use a centralized, shared SSRF guard model provided by the plugin-sdk. Specifically, vulnerable direct fetch calls were replaced with fetchWithSsrFGuard, and the custom authentication fetch logic was replaced by fetchWithBearerAuthScopeFallback. This ensures that all media-related outbound requests are subject to a consistent and robust set of security policies, primarily by validating hostnames against an allowlist and preventing requests to internal or reserved IP addresses, thus mitigating the SSRF risk.

Vulnerable functions

safeFetch

extensions/msteams/src/attachments/shared.ts

This function was a custom implementation of a "safe" fetch intended to prevent SSRF attacks by validating hostnames and resolved IP addresses. However, it was part of a plugin-local implementation that was bypassed in some code paths, and it was not uniformly applied. The vulnerability description mentions that "Some paths bypassed the shared SSRF guard model". The fix removed this function and standardized on the `fetchWithSsrFGuard` provided by the plugin SDK.

fetchWithAuthFallback

extensions/msteams/src/attachments/download.ts

This function implemented a custom authentication and fetch logic that relied on the vulnerable `safeFetch` function for SSRF protection. It was part of a decentralized and inconsistent approach to fetching external media, which led to the SSRF vulnerability. The fix replaced it with a call to the centralized `fetchWithBearerAuthScopeFallback` from the plugin SDK.

fetchGraphCollection

extensions/msteams/src/attachments/graph.ts

This function was responsible for fetching collections from the Microsoft Graph API. The original implementation used a direct `fetchFn` call without consistent SSRF protection. An attacker could potentially control the `params.url` to point to an internal service, leading to an SSRF vulnerability. The fix wraps the fetch call in the centralized `fetchWithSsrFGuard` to enforce SSRF policies.

downloadMSTeamsGraphMedia

extensions/msteams/src/attachments/graph.ts

This function orchestrates the download of media from Microsoft Teams Graph API. The original implementation contained a direct fetch call to the `messageUrl` and also constructed a custom fetcher using the vulnerable `safeFetch` for downloading SharePoint attachments. This created multiple paths where SSRF protection was either missing or inconsistent. The fix consolidates all fetch operations under the `fetchWithSsrFGuard` and a unified SSRF policy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.