@openclaw/msteams 2026.2.6

Direct Vulnerabilities

Known vulnerabilities in the @openclaw/msteams package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Insufficiently Protected Credentials @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the `MS Teams outbound requests`. An attacker can obtain sensitive authentication tokens by accessing configured input paths that expose credentials intended to remain within a trusted boundary. How to fix Insufficiently Protected Credentials? Upgrade `@openclaw/msteams` to version 2026.5.27 or higher.	<2026.5.27
H Insufficiently Protected Credentials @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the `serviceUrl` parameter validation. An attacker can access sensitive authentication data by supplying crafted `serviceUrl` values through configured input paths. How to fix Insufficiently Protected Credentials? Upgrade `@openclaw/msteams` to version 2026.5.28 or higher.	<2026.5.28
M Missing Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Missing Authorization via the `Microsoft Teams SSO invoke handler`. An attacker can gain unauthorized access to Teams SSO signin functionality by sending specially crafted SSO invoke requests that are processed without proper sender validation. How to fix Missing Authorization? Upgrade `@openclaw/msteams` to version 2026.5.1-beta.1 or higher.	<2026.5.1-beta.1
L Incorrect Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Incorrect Authorization in the `Graph API` process. An attacker can access message thread history that should be restricted by sender allowlists by querying the API directly, potentially exposing information to unauthorized users. How to fix Incorrect Authorization? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2
H Denial of Service (DoS) @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Denial of Service (DoS) via the `MS Teams webhook` process. An attacker can cause resource exhaustion by sending unauthenticated requests that are parsed before proper JWT validation. How to fix Denial of Service (DoS)? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2
M Incorrect Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Incorrect Authorization in the feedback invocation process. An attacker can record unauthorized session feedback or trigger feedback reflection by bypassing sender allowlist checks. How to fix Incorrect Authorization? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2
L Incorrect Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Incorrect Authorization through improper access control in the pairing store process. An attacker can gain unauthorized access to another account's direct message pairing by leveraging approval from a different account in multi-account deployments. How to fix Incorrect Authorization? Upgrade `@openclaw/msteams` to version 2026.3.1 or higher.	<2026.3.1
M Missing Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Missing Authorization via `fileConsent/invoke`. An attacker can access or manipulate pending file uploads belonging to other conversations by providing a valid `uploadId` within its time-to-live period, allowing unauthorized completion or cancellation of uploads across conversations. How to fix Missing Authorization? Upgrade `@openclaw/msteams` to version 2026.2.25 or higher.	<2026.2.25
L Server-side Request Forgery (SSRF) @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via inconsistent enforcement of host and DNS policies in the media fetch process. An attacker can access internal network resources or unintended hosts by exploiting fetch paths that bypass shared guard logic. How to fix Server-side Request Forgery (SSRF)? Upgrade `@openclaw/msteams` to version 2026.3.1 or higher.	<2026.3.1
C Authentication Bypass Using an Alternate Path or Channel @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can impersonate authorized users and execute privileged commands by sending forged HTTP POST requests with spoofed fields in the update payload. Note: This is only exploitable if the Telegram webhook is enabled and no webhook secret is configured. How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade `@openclaw/msteams` to version 2026.2.13 or higher.	<2026.2.13

Vulnerability

Vulnerable Version

Insufficiently Protected Credentials