CVE-2026-28481: OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching
OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be enabled) that leaks bearer tokens to allowlisted suffix domains. When retrying downloads after receiving 401 or 403 responses, the application sends Authorization bearer tokens to untrusted hosts matching the permissive suffix-based allowlist, enabling token theft.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28481?
CVE-2026-28481 is classified as an information disclosure vulnerability.
How do I fix CVE-2026-28481?
To fix CVE-2026-28481, upgrade OpenClaw to version 2026.2.1 or later.
Which versions of OpenClaw are affected by CVE-2026-28481?
OpenClaw versions 2026.1.30 and earlier are affected by CVE-2026-28481.
What type of vulnerability is CVE-2026-28481?
CVE-2026-28481 is an information disclosure vulnerability related to bearer token leakage.
Is the MS Teams attachment downloader feature required to be affected by CVE-2026-28481?
Yes, the optional MS Teams attachment downloader feature must be enabled for CVE-2026-28481 to be exploitable.