CVE-2026-35654

CVE-2026-35654 is an authorization bypass vulnerability affecting OpenClaw versions prior to 2026.3.25, specifically in Microsoft Teams feedback invoke functionality. The flaw allows unauthenticated attackers to circumvent sender allowlist controls and trigger unauthorized session feedback recording or reflection through feedback invoke endpoints. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network attack vector, low complexity, and no authentication requirements. The primary impact is integrity compromise through unauthorized feedback recording, with no confidentiality or availability implications. The EPSS score of 0.00037 indicates this threat has relatively lower exploitation probability compared to the broader CVE landscape. There is currently no evidence of active exploitation, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat intelligence hotlists. This suggests limited community attention and no publicly available exploit code at this time. Organizations should prioritize patching to version 2026.3.25 or later as part of routine maintenance, though the immediate exploitation risk remains low.