CVE-2026-62213

EUVD-2026-45101
OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 28.67%
Affected Products (NVD)
VendorProductVersion
openclawopenclaw
𝑥
< 2026.5.27
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/openclaw/openclaw/security/advisories/GHSA-v54h-q2vx-vgg4
https://www.vulncheck.com/advisories/openclaw-token-leakage-via-ms-teams-outbound-requests