CVE-2026-32037: OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling
OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.2.22 - Configuration
Validate the entire redirect chain during MSTeams media downloads and block any redirects that resolve to hosts not present in the mediaAllowHosts allowlist.
OpenClaw MSTeams media download handling mediaAllowHosts = only permit redirects to hosts listed in mediaAllowHosts
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32037?
CVE-2026-32037 has a moderate severity level due to its potential impact on media host allowlist bypass in MSTeams attachment handling.
How do I fix CVE-2026-32037?
To fix CVE-2026-32037, upgrade to OpenClaw version 2026.2.22 or later, where the redirect chain validation has been improved.
What is the impact of CVE-2026-32037?
CVE-2026-32037 allows attackers to manipulate media downloads by bypassing configured allowlists, potentially leading to unauthorized media access.
Which versions of OpenClaw are affected by CVE-2026-32037?
OpenClaw versions prior to 2026.2.22 are affected by CVE-2026-32037 and require an upgrade for protection.
Is there a workaround for CVE-2026-32037 until I can upgrade?
There is no official workaround for CVE-2026-32037, and upgrading to the latest version is strongly recommended.