CyberRota Analysis
AI-GeneratedOpenClaw versions prior to 2026.5.28 are vulnerable due to a race condition in the MS Teams safeFetch DNS rebinding check, which could allow lower-trust callers to bypass authorization checks. This vulnerability poses a significant risk as it may enable unauthorized actions depending on the operator's configuration and the accessibility of lower-trust inputs. Organizations using affected versions should prioritize patching to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Related CVEs
Other vulnerabilities affecting the same vendor(s)