Homepage

@openclaw/msteams@2026.1.29

OpenClaw Microsoft Teams channel plugin for bot conversations.

  • latest version

    2026.7.1

  • latest non vulnerable version

    2026.8.1-beta.2

  • first published

    6 months ago

  • latest version published

    1 months ago

  • View msteams package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @openclaw/msteams package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insufficiently Protected Credentials

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the MS Teams outbound requests. An attacker can obtain sensitive authentication tokens by accessing configured input paths that expose credentials intended to remain within a trusted boundary.

    How to fix Insufficiently Protected Credentials?

    Upgrade @openclaw/msteams to version 2026.5.27 or higher.

    <2026.5.27
    • H
    Insufficiently Protected Credentials

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the serviceUrl parameter validation. An attacker can access sensitive authentication data by supplying crafted serviceUrl values through configured input paths.

    How to fix Insufficiently Protected Credentials?

    Upgrade @openclaw/msteams to version 2026.5.28 or higher.

    <2026.5.28
    • M
    Missing Authorization

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Missing Authorization via the Microsoft Teams SSO invoke handler. An attacker can gain unauthorized access to Teams SSO signin functionality by sending specially crafted SSO invoke requests that are processed without proper sender validation.

    How to fix Missing Authorization?

    Upgrade @openclaw/msteams to version 2026.5.1-beta.1 or higher.

    <2026.5.1-beta.1
    • L
    Incorrect Authorization

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Incorrect Authorization in the Graph API process. An attacker can access message thread history that should be restricted by sender allowlists by querying the API directly, potentially exposing information to unauthorized users.

    How to fix Incorrect Authorization?

    Upgrade @openclaw/msteams to version 2026.5.2 or higher.

    <2026.5.2
    • H
    Denial of Service (DoS)

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Denial of Service (DoS) via the MS Teams webhook process. An attacker can cause resource exhaustion by sending unauthenticated requests that are parsed before proper JWT validation.

    How to fix Denial of Service (DoS)?

    Upgrade @openclaw/msteams to version 2026.5.2 or higher.

    <2026.5.2
    • M
    Incorrect Authorization

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Incorrect Authorization in the feedback invocation process. An attacker can record unauthorized session feedback or trigger feedback reflection by bypassing sender allowlist checks.

    How to fix Incorrect Authorization?

    Upgrade @openclaw/msteams to version 2026.5.2 or higher.

    <2026.5.2
    • L
    Incorrect Authorization

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Incorrect Authorization through improper access control in the pairing store process. An attacker can gain unauthorized access to another account's direct message pairing by leveraging approval from a different account in multi-account deployments.

    How to fix Incorrect Authorization?

    Upgrade @openclaw/msteams to version 2026.3.1 or higher.

    <2026.3.1
    • M
    Missing Authorization

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Missing Authorization via fileConsent/invoke. An attacker can access or manipulate pending file uploads belonging to other conversations by providing a valid uploadId within its time-to-live period, allowing unauthorized completion or cancellation of uploads across conversations.

    How to fix Missing Authorization?

    Upgrade @openclaw/msteams to version 2026.2.25 or higher.

    <2026.2.25
    • L
    Server-side Request Forgery (SSRF)

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via inconsistent enforcement of host and DNS policies in the media fetch process. An attacker can access internal network resources or unintended hosts by exploiting fetch paths that bypass shared guard logic.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade @openclaw/msteams to version 2026.3.1 or higher.

    <2026.3.1
    • H
    Insertion of Sensitive Information Into Sent Data

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the process that handles downloading inbound MS Teams attachments or inline images, specifically when retrying URLs with an Authorization header after receiving certain HTTP responses. An attacker can obtain sensitive bearer tokens by crafting messages that reference untrusted but allowlisted hosts, causing the token to be sent to unintended domains.

    Note: This only affects deployments that enable the optional MS Teams extension (Teams channel). If you do not use MS Teams, you are not impacted.

    How to fix Insertion of Sensitive Information Into Sent Data?

    Upgrade @openclaw/msteams to version 2026.2.1 or higher.

    <2026.2.1
    • C
    Authentication Bypass Using an Alternate Path or Channel

    @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin

    Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can impersonate authorized users and execute privileged commands by sending forged HTTP POST requests with spoofed fields in the update payload.

    Note: This is only exploitable if the Telegram webhook is enabled and no webhook secret is configured.

    How to fix Authentication Bypass Using an Alternate Path or Channel?

    Upgrade @openclaw/msteams to version 2026.2.13 or higher.

    <2026.2.13
    Go back to all versions of this package