CVE-2026-43572

תיאור (מקור, אנגלית)

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality.

מדדים

CVSS 3.1

5.3 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

6.3 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-28/9/2026

CWE

CWE-862

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gc9r-867r-j85f Vendor Advisory
• https://github.com/openclaw/openclaw/commit/80b1fa17bfc3f6a668492f0326ea52f48b‮… Patch
• https://www.vulncheck.com/advisories/openclaw-missing-sender-authorization-in-‮… Third Party Advisory