CVE-2026-100550
Received Received - Intake

OpenClaw Teams Integration Access-Control Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admission check, so a Teams member who is not on the allowlist can still trigger the configured agent despite the administrator's group boundary. The impact depends on the conversations, tools, and data available to that agent. The issue is fixed in version 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100550
EUVD
EUVD-2026-87500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw before version 2026.8.1 has an access-control bypass in its Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported access group causes a denied group-resolution result that bypasses the final message-admission check. This allows a Teams member not on the allowlist to trigger the configured agent despite administrator restrictions.

Detection Guidance

To detect this vulnerability, check the installed version of the openclaw npm package. If it is below 2026.8.1, the system is vulnerable. Run: npm list openclaw or npm ls openclaw to verify the version. Also review Microsoft Teams integration configurations for any unresolved or unsupported access-group entries that may allow unauthorized access.

Impact Analysis

The impact depends on the conversations, tools, and data accessible to the agent. An unlisted Teams member could interact with restricted resources or tools, potentially leading to unauthorized actions or data exposure. The vulnerability does not affect trusted operators or local execution surfaces unless separate security boundaries are crossed.

Mitigation Strategies

Immediately upgrade the openclaw package to version 2026.8.1 or later using: npm install openclaw@2026.8.1. Before upgrading, ensure all access-group entries are resolved and use explicit allowlists for senders or conversations to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100550. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart