PT-2026-23555 · Openclaw+2 · Openclaw+2

Vincent Koc · Publicado 2026-02-14 · Atualizado 2026-06-06 · CVE-2026-28480

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3

Description The Telegram allowlist authorization mechanism incorrectly matched on mutable usernames (@username) instead of immutable numeric sender IDs. This allowed attackers to spoof identity by obtaining recycled usernames, bypassing allowlist restrictions and interacting with bots as unauthorized senders. This poses an identity rebinding and spoofing risk for operators who rely on Telegram allowlists as strict identity controls. The issue was addressed by requiring numeric Telegram sender IDs for allowlist authorization and rejecting usernames. A security audit warning was added to flag legacy configurations containing non-numeric Telegram allowlist entries. The openclaw doctor --fix command now attempts to resolve username allowFrom entries to numeric IDs.

Recommendations Versions prior to 2026.2.14: Update to version 2026.2.14 or later. Versions prior to 2026.1.24-3: Update to version 2026.1.24-3 or later. Run openclaw doctor --fix to resolve any legacy configurations containing non-numeric Telegram allowlist entries.

Correção

Improper Access Control

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-284

CWE-290

Identificadores relacionados

BDU:2026-06158

CVE-2026-28480

GHSA-MJ5R-HH7J-4GXF

Produtos afetados

Openclaw

Telegram

Clawdbot

Referências · 15

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/9e147f00b48e63e7be6964e0e2a97f2980854128 · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/e3b432e481a96b8fd41b91273818e514074e05c3 · Correção
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Nota
• https://twitter.com/threadlinqs/status/2063251795380461792 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-identity-spoofing-via-mutable-username-in-telegram-allowlist-authorization · Nota
• https://twitter.com/CveFindCom/status/2029689339421086111 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-06158 · Nota de Segurança
• https://twitter.com/threadlinqs/status/2063252123551170708 · Publicação no Twitter
• https://twitter.com/threadlinqs/status/2063262739741467063 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mj5r-hh7j-4gxf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28480 · Aviso do Fabricante
• https://t.me/CVEtracker/46499 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-28480 · Nota de Segurança