Advisory details:
github_osv / GHSA-rf6h-5gpw-qrgq
| Advisory ID | github_osv/GHSA-rf6h-5gpw-qrgq |
| Aliases |
CVE-2026-35654
|
| Summary | OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback ## Summary MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Microsoft Teams feedback invokes previously bypassed sender authorization and could record feedback or trigger reflection for unauthorized senders. Commit `c5415a474bb085404c20f8b312e436997977b1ea` applies the same DM and group authorization checks to feedback invokes. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `c5415a474bb085404c20f8b312e436997977b1ea`. ## Fix Commit(s) - `c5415a474bb085404c20f8b312e436997977b1ea` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-13T17:43:38Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35654.json
Source Advisory: vulnrichment/CVE-2026-35654
[{'Exploitation': 'none'},
{'Automatable': 'yes'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]