PT-2026-32313 · Npm · Openclaw

Publicado 2026-04-03 · Atualizado 2026-04-03

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Telegram audio preflight transcription enables resource consumption by unauthorized senders

Current Maintainer Triage

• Status: narrow
• Normalized severity: medium
• Assessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• c4fa8635d03943ffe9e294d501089521dca635c5 — 2026-03-30T12:19:31+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-408

CWE-770

Identificadores relacionados

GHSA-M6FX-M8HC-572M

Produtos afetados

Openclaw

Referências · 7

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-m6fx-m8hc-572m · Nota
• https://github.com/openclaw/openclaw/commit/c4fa8635d03943ffe9e294d501089521dca635c5 · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41331 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-resource-consumption-via-unauthorized-telegram-audio-preflight-transcription · Nota
• https://osv.dev/vulnerability/GHSA-m6fx-m8hc-572m · Aviso do Fabricante