Root cause
Caller-supplied target bypasses allowlist
Because getMessageMSTeams builds the Graph path directly from to, a lower-trust sender or steered agent could read messages or metadata from excluded Teams conversations.
OpenClaw's chat plugins read messages from any conversation a caller named, ignoring the allowlist; a Claude Code change added the Teams read action with the same unchecked pattern.
Provisional finding. Full causal and release verification remains incomplete.
What actually happenedHide details
The Matrix, Feishu and Google Chat read actions, written by humans, passed a caller-supplied target to the provider without checking the configured allowlist. The AI-written Teams read action, added in 2026.3.28, did the same, so a lower-trust sender or steered agent could read excluded conversations. Fixed in 2026.8.1.
AI-assisted change
A Claude Opus 4.6 co-authored change added the Teams read handlers; like the earlier human-written Matrix, Feishu, and Google Chat reads, they passed a caller-supplied target to the provider without an allowlist check.
Fix
Fix adds MSTeams read-policy checks
The repair validates the requesting account, current conversation, users, teams, and channels, and routes read-dependent actions through the shared dispatcher's provider gate.
Fix authorship not yet analyzed
Case facts
- GHSA ID
- GHSA-G7FW-3GJP-G5HF
- Published
- Oct 5, 2026
- Severity
- Not scored
- Language
- TypeScript
- AI tool
Claude- AI role
- Flawed AI-written code
- Root cause
- Validation & fail-open logic
- Vulnerable release
- < 2026.8.1 (Teams read handlers from 2026.3.28)
- Fixed release
- 2026.8.1
Cite this finding
Vibe Security Radar, "GHSA-G7FW-3GJP-G5HF in openclaw/openclaw," Georgia Tech SSLab, https://vibesecradar.com/cves/GHSA-G7FW-3GJP-G5HF/
AI-assisted change
AI-assisted changeextensions/msteams/src/graph-messages.tssource openclaw/openclaw@5d55bf315d+89−0
@@ -0,0 +1,173 @@+import type { OpenClawConfig } from "../runtime-api.js";+import { deleteGraphRequest, fetchGraphJson, postGraphJson, resolveGraphToken } from "./graph.js";+Show 28 hidden lines
+type GraphMessageBody = {+ content?: string;+ contentType?: string;+};++type GraphMessageFrom = {+ user?: { id?: string; displayName?: string };+ application?: { id?: string; displayName?: string };+};++type GraphMessage = {+ id?: string;+ body?: GraphMessageBody;+ from?: GraphMessageFrom;+ createdDateTime?: string;+};++type GraphPinnedMessage = {+ id?: string;+ message?: GraphMessage;+};++type GraphPinnedMessagesResponse = {+ value?: GraphPinnedMessage[];+};++/**+ * Resolve the Graph API path prefix for a conversation.+ * If `to` contains "/" it's a `teamId/channelId` (channel path),+ * otherwise it's a chat ID.+ */+function resolveConversationPath(to: string): {+ kind: "chat" | "channel";+ basePath: string;+ chatId?: string;Show 17 hidden lines
+ teamId?: string;+ channelId?: string;+} {+ const trimmed = to.trim();+ if (trimmed.includes("/")) {+ const [teamId, channelId] = trimmed.split("/", 2);+ return {+ kind: "channel",+ basePath: `/teams/${encodeURIComponent(teamId!)}/channels/${encodeURIComponent(channelId!)}`,+ teamId,+ channelId,+ };+ }+ return {+ kind: "chat",+ basePath: `/chats/${encodeURIComponent(trimmed)}`,+ chatId: trimmed,+ };+}++export type GetMessageMSTeamsParams = {+ cfg: OpenClawConfig;+ to: string;+ messageId: string;+};++export type GetMessageMSTeamsResult = {+ id: string;+ text: string | undefined;+ from: GraphMessageFrom | undefined;Show 3 hidden lines
+ createdAt: string | undefined;+};++/**+ * Retrieve a single message by ID from a chat or channel via Graph API.+ */+export async function getMessageMSTeams(+ params: GetMessageMSTeamsParams,+): Promise<GetMessageMSTeamsResult> {+ const token = await resolveGraphToken(params.cfg);+ const { basePath } = resolveConversationPath(params.to);+ const path = `${basePath}/messages/${encodeURIComponent(params.messageId)}`;+ const msg = await fetchGraphJson<GraphMessage>({ token, path });+ return {Show 7 hidden lines
+ id: msg.id ?? params.messageId,+ text: msg.body?.content,+ from: msg.from,+ createdAt: msg.createdDateTime,+ };+}+getMessageMSTeams passes the caller-supplied to value to resolveConversationPath and then directly fetches that Graph message path, without checking the Teams channel or chat allowlist.
Security fix
Fixsrc/channels/plugins/message-action-dispatch.tssource openclaw/openclaw@fbd330b7aa+81−4
@@ -4,11 +4,418 @@ * Runs plugin-owned message actions from the shared agent tool with sender trust checks. */ import type { AgentToolResult } from "../../agents/runtime/index.js";Show 60 hidden lines
-import { getChannelPlugin } from "./index.js";-import type { ChannelMessageActionContext } from "./types.public.js";+import { normalizeOptionalAccountId, normalizeAccountId } from "../../routing/account-id.js";+import { normalizeChatType, type ChatType } from "../chat-type.js";+import { normalizeConversationReadInvocationOrigin } from "./conversation-read-origin.js";+import { resolveChannelPluginRegistration } from "./registry.js";+import type {+ ChannelMessageActionContext,+ ChannelMessageActionName,+ ChannelPlugin,+} from "./types.js"; -function requiresTrustedRequesterSender(ctx: ChannelMessageActionContext): boolean {- const plugin = getChannelPlugin(ctx.channel);+const READ_DEPENDENT_ACTIONS = new Set<ChannelMessageActionName>([+ "poll-vote",+ "react",+ "reactions",+ "read",+ "edit",+ "unsend",+ "delete",+ "pin",+ "unpin",+ "list-pins",+ "permissions",+ "thread-list",+ "search",+ "sticker-search",+ "member-info",+ "role-info",+ "emoji-list",+ "channel-info",+ "channel-list",+ "voice-status",+ "event-list",+ "download-file",+]);++// These bundled adapters have host-reviewed provider-side current/configured+// gates. Other bundled adapters retain the exact-current compatibility limit.+const BUNDLED_CHANNELS_WITH_PROVIDER_READ_GATES = new Set([+ "discord",+ "feishu",+ "matrix",+ "msteams",+ "slack",+]);++type HostConversationTargetKind =+ | "user"+ | "channel"+ | "room"+ | "chat"+ | "group"+ | "dm"+ | "conversation";++type HostConversationTarget = {+ id: string;+ kind?: HostConversationTargetKind;+};++const HOST_TARGET_KIND_PREFIXES = new Set<HostConversationTargetKind>([+ "user",+ "channel",+ "room",Show 12 hidden lines
+ "chat",+ "group",+ "dm",+ "conversation",+]);++function stripHostProviderPrefix(params: {+ value: string;+ channel: string;+ providerPrefixes?: readonly string[];+}): string {+ const prefixes = [params.channel, ...(params.providerPrefixes ?? [])]+ .map((prefix) => prefix.trim().toLowerCase())+ .filter(+ (prefix): prefix is string =>+ Boolean(prefix) && !HOST_TARGET_KIND_PREFIXES.has(prefix as HostConversationTargetKind),+ );+ const lowered = params.value.toLowerCase();+ const prefix = prefixes.find((candidate) => lowered.startsWith(`${candidate}:`));The shared message-action dispatcher now gates read-dependent actions and treats msteams as a provider with read gates, routing reads through the new trust and conversation checks.
Fixextensions/msteams/src/read-policy.tssource openclaw/openclaw@fbd330b7aa+89−0
@@ -0,0 +1,416 @@+import { ToolAuthorizationError } from "openclaw/plugin-sdk/channel-actions";+import type { ChannelMessageActionContext } from "openclaw/plugin-sdk/channel-contract";+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";Show 9 hidden lines
+import type { OpenClawConfig } from "../runtime-api.js";+import { isDangerousNameMatchingEnabled, resolveDefaultGroupPolicy } from "../runtime-api.js";+import { listChannelsForTeamWithPageInfo, resolveGraphToken } from "./graph.js";+import { resolveMSTeamsRouteConfig } from "./policy.js";+import {+ normalizeMSTeamsMessagingTarget,+ looksLikeMSTeamsConversationId,+ resolveMSTeamsChannelAllowlist,+ resolveMSTeamsTeamsConfig,+ resolveMSTeamsUserAllowlist,+} from "./resolve-allowlist.js";++type MSTeamsReadContext = Pick<+ ChannelMessageActionContext,+ "accountId" | "conversationReadOrigin" | "requesterAccountId" | "toolContext"+>;Show 2 hidden lines
++function normalizeTarget(raw?: string | null): string {+ return raw ? (normalizeMSTeamsMessagingTarget(raw) ?? "") : "";+}++function sameAccount(ctx: MSTeamsReadContext): boolean {+ const requested = normalizeOptionalString(ctx.accountId) ?? "default";+ const requester = normalizeOptionalString(ctx.requesterAccountId);+ return requester !== undefined && requester === requested;+}++export function isCurrentMSTeamsReadTarget(params: {+ ctx: MSTeamsReadContext;+ target: string;+}): boolean {+ if (Show 54 hidden lines
+ normalizeOptionalString(params.ctx.toolContext?.currentChannelProvider)?.toLowerCase() !==+ "msteams" ||+ !sameAccount(params.ctx)+ ) {+ return false;+ }+ const candidates = [+ params.ctx.toolContext?.currentChannelId,+ params.ctx.toolContext?.currentMessagingTarget,+ params.ctx.toolContext?.currentGraphChannelId,+ ];+ const target = normalizeTarget(params.target);+ return candidates.some((candidate) => normalizeTarget(candidate) === target);+}++function normalizeUserTarget(target: string): string {+ return target+ .replace(/^user:/i, "")+ .trim()+ .toLowerCase();+}++function isStableUserId(value: string): boolean {+ return /^[0-9a-f-]{16,}$/i.test(value);+}++async function resolveAllowedDmTarget(+ cfg: OpenClawConfig,+ target: string,+): Promise<string | undefined> {+ const teams = cfg.channels?.msteams;+ if (teams?.dmPolicy === "disabled") {+ return undefined;+ }+ const userId = normalizeUserTarget(target);+ if (!userId) {+ return undefined;+ }+ const allowFrom = teams?.allowFrom ?? [];+ const normalizedEntries = allowFrom.map((entry) =>+ normalizeUserTarget(entry.replace(/^(msteams|teams):/i, "")),+ );+ const allowAll = (teams?.dmPolicy ?? "pairing") === "open" || normalizedEntries.includes("*");+ if (isStableUserId(userId)) {+ return allowAll || normalizedEntries.some((entry) => entry === userId)+ ? `user:${userId}`+ : undefined;+ }+ if (!isDangerousNameMatchingEnabled(teams)) {+ return undefined;+ }+ try {+ const [resolvedTarget, ...resolvedEntries] = await resolveMSTeamsUserAllowlist({+ cfg,Adds an MSTeams read policy that checks the requesting account, current conversation target, DM and user allowlist, and team and channel allowlist before permitting a read.
Patch fingerprints
AI-assisted change e7732154b1dc7c2434869e2c3d97c8f5da6dee580527cc6c750658dbaee785bd · Fix 2b7ccda4e1ffb17704b5bfbea540e91f1da474ae2d47d463dc21064ad03a8a8c
More findings in openclaw/openclaw
All 33 →- An AI-assisted pull request, marked [AI] per the repository's convention, tried to harden device.pair.approve by adding an approve-side role check, but applied it only to device-token callers, leaving the pre-existing flaw for other sessions.
CVE-2026-62218Jul 17, 2026openclaw/openclaw
TypeScript
ChatGPT/CodexFlawed AI-written codeAuthentication & access control - Claude-coauthored Slack approval code reused an exec-only approver check for plugin approvals, letting exec approvers bypass channel rules.
GHSA-WV26-J37Q-2G7PJul 2, 2026openclaw/openclaw
TypeScriptClaudeFlawed AI-written codeInjection & unsafe execution - An AI-assisted trusted-proxy exception let fresh, unapproved Control UI devices retain client-requested scopes before server-side pairing approved them. The original device-less path cleared scopes and must be distinguished from the fresh-device path. Trusted-proxy authentication alone did not establish device privilege. An initial clamp removed unapproved scopes, a later change reintroduced the exception, and a subsequent pairing repair closed that recurrence. Source and published package provenance support discontinuous affected windows, without certifying every historical package or attributing the recurrence to AI.
GHSA-QJPC-QF9M-XWMRJul 2, 2026openclaw/openclaw
TypeScript
CursorDirect introductionAuthentication & access control - A change generated with Claude Code and co-authored by Claude Opus 4.6 introduced the Feishu plugin's dynamic-agent creation, which writes new agents, sender bindings and their directories into the operator config without consulting the resolveChannelConfigWrites policy.
CVE-2026-53835Jul 2, 2026openclaw/openclaw
TypeScriptClaudeDirect introductionOther or unclear - AI-written code trusted a CDP /json/version webSocketDebuggerUrl without re-validating its host, allowing a second-hop SSRF-style pivot to untrusted targets.
MediumCVE-2026-43576Apr 17, 2026openclaw/openclaw
JavaScriptClaudeNew attack surfaceSSRF & network boundaries