The flaw is a race condition in OpenClaw’s Microsoft Teams safeFetch DNS rebinding check, present in all releases older than 2026.5.28. When the feature is enabled and reachable, a lower‑trust caller or a specific input path can win the timing window between the DNS validation and its actual use. This allows that caller to perform actions that normally require stronger authorization or policy checks. The result is an authentication bypass that can lead to the execution of privileged operations, with the concrete impact depending on how the operator has configured trust boundaries. This weakness is classified as CWE‑367 (Race Condition).

The vulnerability affects all OpenClaw installations for the Node.js platform with versions earlier than 2026.5.28. Operators running those releases should locate deployments of the OpenClaw:OpenClaw product where the safeFetch feature is enabled.

The CVSS score of 5.1 reflects moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, and no public exploits are known. Exploitation would require an attacker to reach the affected feature and to provide a lower‑trust input capable of racing the validation check, making the attack surface highly dependent on operator configuration. Consequently, the practical risk ranges from negligible when the feature is isolated to significant if it is exposed to untrusted callers.