PT-2026-20791 · Telegram+1 · Telegram Bot Api+1

Aether-Ai-Agent · Published 2026-02-18 · Updated 2026-03-01 · CVE-2026-27003

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description The application logs Telegram bot tokens without redaction when they appear in error messages or stack traces, such as in request URLs including https://api.telegram.org/bot<token>/.... This can lead to the leakage of the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and gain full Bot API access.

Recommendations Upgrade to version 2026.2.15 or later. Rotate the Telegram bot token if it may have been exposed.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-27003

GHSA-CHF7-JQ6G-QRWV

Affected Products

Openclaw

Telegram Bot Api

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27003.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-chf7-jq6g-qrwv · Patch
• https://github.com/openclaw/openclaw/commit/cf69907015b659e5025efb735ee31bd05c4ee3d5 · Patch
• https://osv.dev/vulnerability/CVE-2026-27003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27003 · Security Note
• https://osv.dev/vulnerability/GHSA-chf7-jq6g-qrwv · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CoyoteSecure/status/2028211943627256241 · Twitter Post
• https://twitter.com/CVEarity/status/2024835569101291704 · Twitter Post