PT-2026-20324 · Telegram+1 · Telegram+1

Yueyuel · Published 2026-02-17 · Updated 2026-02-23 · CVE-2026-25474

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.2.1

Description In Telegram webhook mode, if channels.telegram.webhookSecret is not set, the software may accept webhook HTTP requests without verifying Telegram’s secret token header. This can allow forged Telegram updates, such as spoofing message.from.id, if the webhook endpoint is reachable by an attacker. Telegram webhook mode is not enabled by default and requires configuration of channels.telegram.webhookUrl. An attacker who can reach the webhook endpoint may be able to send forged updates that are processed as if they came from Telegram, potentially leading to unintended bot actions. The vulnerable component is the webhook functionality.

Recommendations versions prior to 2026.2.1: Set a strong channels.telegram.webhookSecret and ensure your reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged. versions prior to 2026.2.1: Restrict network access to the webhook endpoint. versions prior to 2026.2.1: As a temporary workaround, consider disabling Telegram webhook mode by not configuring channels.telegram.webhookUrl.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-25474

GHSA-MP5H-M6QJ-6292

Affected Products

Telegram

Openclaw

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25474.json · Exploit
• https://github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930 · Patch
• https://github.com/openclaw/openclaw/commit/5643a934799dc523ec2ef18c007e1aa2c386b670 · Patch
• https://github.com/openclaw/openclaw/commit/633fe8b9c17f02fcc68ecdb5ec212a5ace932f09 · Patch
• https://github.com/openclaw/openclaw/commit/ca92597e1f9593236ad86810b66633144b69314d · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mp5h-m6qj-6292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25474 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25474 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp5h-m6qj-6292 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.1 · Note
• https://twitter.com/CVEnew/status/2025892105562816676 · Twitter Post
• https://twitter.com/dailycve/status/2023986986533507340 · Twitter Post
• https://t.me/CVEtracker/45045 · Telegram Post