@openclaw/msteams 2026.5.2-beta.1

Direct Vulnerabilities

Known vulnerabilities in the @openclaw/msteams package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Insufficiently Protected Credentials @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the `MS Teams outbound requests`. An attacker can obtain sensitive authentication tokens by accessing configured input paths that expose credentials intended to remain within a trusted boundary. How to fix Insufficiently Protected Credentials? Upgrade `@openclaw/msteams` to version 2026.5.27 or higher.	<2026.5.27
H Insufficiently Protected Credentials @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the `serviceUrl` parameter validation. An attacker can access sensitive authentication data by supplying crafted `serviceUrl` values through configured input paths. How to fix Insufficiently Protected Credentials? Upgrade `@openclaw/msteams` to version 2026.5.28 or higher.	<2026.5.28
L Incorrect Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Incorrect Authorization in the `Graph API` process. An attacker can access message thread history that should be restricted by sender allowlists by querying the API directly, potentially exposing information to unauthorized users. How to fix Incorrect Authorization? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2
H Denial of Service (DoS) @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Denial of Service (DoS) via the `MS Teams webhook` process. An attacker can cause resource exhaustion by sending unauthenticated requests that are parsed before proper JWT validation. How to fix Denial of Service (DoS)? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2
M Incorrect Authorization @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Incorrect Authorization in the feedback invocation process. An attacker can record unauthorized session feedback or trigger feedback reflection by bypassing sender allowlist checks. How to fix Incorrect Authorization? Upgrade `@openclaw/msteams` to version 2026.5.2 or higher.	<2026.5.2

Vulnerability

Vulnerable Version

Insufficiently Protected Credentials