CVE-2026-100550 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw deployments, especially those using the Microsoft Teams integration, should assess their exposure and verify their version of OpenClaw. This includes reviewing the current version and upgrading to 2026.8.1 or later if necessary. Additionally, defenders should review and update Microsoft Teams integration configurations to ensure proper access controls and assess the potential impact of the vulnerability in their

Why it matters

CVE-2026-100550 is a medium-severity vulnerability in OpenClaw that could allow unauthorized access to certain agents. Defenders should prioritize verifying their OpenClaw version and assessing exposure, especially if using the Microsoft Teams integration.

• Potential unauthorized access to certain agents despite administrative group boundaries
• Possible exposure of conversations, tools, and data available to the agent
• Need to verify OpenClaw version and assess exposure
• Potential impact on data integrity and confidentiality

Technical summary

The OpenClaw npm package before version 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group can lead to a denied group-resolution result that is not rejected by the final message-admission check. This allows a Teams member not on the allowlist to trigger the configured agent despite administrative group boundaries.

Defensive priority

Defenders should prioritize verifying their OpenClaw version and assessing exposure, especially if using the Microsoft Teams integration.

Recommended defensive actions

• Verify OpenClaw version and upgrade to 2026.8.1 or later if necessary
• Assess exposure and potential impact of the vulnerability in your environment
• Review and update Microsoft Teams integration configurations to ensure proper access controls
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information from the vendor and other sources may be necessary for a comprehensive understanding. The vulnerability is fixed in version 2026.8.1. OpenClaw deployments, especially those using the Microsoft Teams integration, should verify their version and assess exposure. The CVSS score for this vulnerability is 5.3, indicating a medium severity. The impact depends on the conversations, tools, and data available to the agent. Defenders should review

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.