N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-chfm-xgc4-47rj

GHSA-chfm-xgc4-47rj: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Summary

MSTeams thread history bypasses sender allowlist via Graph API

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: Real in shipped v2026.3.28 MS Teams because Graph-fetched thread history bypasses sender allowlists, with unreleased mainline filtering fix.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

5cca38084074fb5095aa11b6a59820d63e4937c9 — 2026-03-30T15:38:26+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-chfm-xgc4-47rj

GHSA-chfm-xgc4-47rj:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch 5cca38084074fb5095aa11b6a59820d63e4937c9 clearly indicates the source of the vulnerability. The patch modifies the createMSTeamsMessageHandler function in extensions/msteams/src/monitor-handler/message-handler.ts. Specifically, it introduces filtering logic that was previously absent. Before the fix, the code fetched all messages in a thread (allMessages) and immediately formatted them for context using formatThreadContext. The patch adds a step to filter allMessages based on the groupPolicy and effectiveGroupAllowFrom settings, ensuring that only messages from allowlisted senders are included in the threadMessages that get formatted. The added test case, filters non-allowlisted thread messages out of BodyForAgent, further confirms that the vulnerability was the failure to filter thread history, allowing a non-allowlisted user's messages to be processed. Therefore, the handler created by createMSTeamsMessageHandler is the vulnerable function.

Vulnerable functions

createMSTeamsMessageHandler

extensions/msteams/src/monitor-handler/message-handler.ts

The vulnerability lies within the message handler function created by `createMSTeamsMessageHandler`. This handler fetches MS Teams thread history, including the parent message and replies. Before the patch, it would format the entire thread history for context without checking if each message sender was on the configured allowlist. This allowed messages from unauthorized users to be included in the agent's view of the conversation history, bypassing the sender allowlist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.