Openclaw cli: OpenClaw MS Teams inbound attachment downloader leaks bearer tokens to allowlisted suffix domains (CVE-2026-28481)

OpenClaw CLI's MS Teams extension downloads inbound attachments and inline images by retrying URLs with an Authorization: Bearer token header after 401 or 403 responses. The default allowlist for download hosts uses suffix matching, which includes some multi-tenant suffix domains. This allows bearer tokens to be sent to untrusted hosts that match the allowlist suffixes, potentially leaking sensitive tokens. The vulnerability affects openclaw versions <= 2026.1.30 and is fixed in >= 2026.2.1. Workarounds include disabling the MS Teams extension or restricting the auth host allowlist to only Microsoft-owned endpoints.

Bearer tokens used for authorization in MS Teams attachment downloads may be leaked to untrusted but allowlisted suffix domains, potentially exposing sensitive authentication tokens. This could allow unauthorized access to resources protected by those tokens. The vulnerability is rated high severity with a CVSS 3.1 score of 7.4, indicating a network attack vector with low complexity and no privileges required but requiring user interaction. The impact is confidentiality loss without integrity or availability impact.

A fix is available in openclaw version 2026.2.1 and later; upgrading to this version fully mitigates the vulnerability. If upgrading is not possible, disable the MS Teams extension to avoid exposure. Alternatively, restrict the authorization host allowlist to only include Microsoft-owned endpoints that require authentication, avoiding wildcard or broad suffix entries to prevent token leakage.