OpenClaw Bot Framework accepts a serviceUrl parameter without proper validation, allowing callers with lower trust levels to input arbitrary URLs. When a malicious value is supplied through configured input paths, the framework can reveal bot tokens and credentials that are intended to stay within the trusted environment. The exposure of these authentication materials enables an attacker to impersonate legitimate bots, gain unauthorized access to connected services, or potentially pivot to other systems.

OpenClaw Bot Framework for Microsoft Teams, versions prior to 2026.5.28.

The CVSS score of 6 indicates a moderate risk. The EPSS score is below 1%, suggesting that exploitation is unlikely at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker to supply a crafted serviceUrl via a configured input path, which is only possible if the caller has lower trust permissions or can bypass the normal validation logic. Because the flaw lies in input validation (CWE‑522), an exploit would allow an attacker to retrieve sensitive authentication data beyond the intended boundary.