What’s Vulnerable › Vulnerabilities

CVE-2026-100550: OpenClaw before 2026.8.1 Authentication Bypass via Access Group

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-09-28
• Weakness: CWE-863

Description

OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admission check, so a Teams member who is not on the allowlist can still trigger the configured agent despite the administrator's group boundary. The impact depends on the conversations, tools, and data available to that agent. The issue is fixed in version 2026.8.1.

Affected products

• OpenClaw: before 2026.8.1 — fixed in 2026.8.1

How to fix

Upgrade to a fixed version: OpenClaw 2026.8.1. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8938-r7c6-54vq
• https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authentication-bypass-via-access-group

Get alerted when CVE-2026-100550 or the next vulnerability affects your stack