CVE-2026-62214mediumCWE-522

CVE-2026-62214: medium-severity vulnerability in openclaw msteams

OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation

Published · Updated

Follow this CVE+ Monitor msteams

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6epss 0.4%
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
openclaw · msteams
Related CVEs — openclaw msteams

In the same product, most dangerous first.

CVE-2026-62213MEDIUMOpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound RequestsEPSS 0.4%CVE-2026-62224LOWOpenClaw MS Teams < 2026.5.12 Authorization BypassEPSS 0.3%CVE-2026-100582HIGHOpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist BypassEPSS 0.2%