CVE-2026-62213 describes a token leakage vulnerability in OpenClaw msteams versions before 2026.5.27. The flaw allows lower-trust callers to expose Bot Framework tokens by accessing configured input paths through MS Teams outbound requests. This occurs due to insufficient protection of credentials, enabling attackers to retrieve sensitive tokens that should remain confined within a trusted environment. The vulnerability has a CVSS 4.0 score of 6.0, indicating a medium severity level. There is no vendor advisory or patch information available at this time, and the product is not a cloud service, so remediation responsibility lies with the user.

An attacker with lower-trust caller privileges can exploit this vulnerability to access Bot Framework tokens by leveraging MS Teams outbound requests. This exposure of credentials could lead to unauthorized actions or access within the context of the affected OpenClaw msteams integration. The vulnerability does not require user interaction and has a low attack complexity, but it does require partial privileges (PR:L). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor for vendor updates and consider restricting access to configured input paths or limiting lower-trust caller privileges as a precautionary measure until a patch is available.