OpenClaw versions up to 2026.3.28 have a vulnerability where Microsoft Teams thread history accessed via the Graph API bypasses sender allowlists. This issue allows thread history to be fetched without proper sender filtering. The vulnerability is fixed in version 2026.3.31.