CVE-2026-62213 describes a token leakage vulnerability in OpenClaw msteams versions before 2026.5.27. The issue arises from insufficient protection of credentials in MS Teams outbound requests, enabling lower-trust callers to expose Bot Framework tokens. Attackers can exploit this by accessing configured input paths to retrieve sensitive credentials that should remain confined within trusted boundaries. The vulnerability has a CVSS 4.0 base score of 6.0, indicating medium severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with lower trust privileges can access Bot Framework tokens by exploiting the token leakage vulnerability in MS Teams outbound requests. This exposure of credentials could lead to unauthorized use of the bot framework tokens, potentially compromising the confidentiality of communications or bot operations. However, there is no indication of privilege escalation, integrity, or availability impact beyond credential exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected OpenClaw msteams versions and monitor for suspicious activity related to Bot Framework tokens. Avoid exposing lower-trust callers to MS Teams outbound request paths that handle sensitive tokens.