PT-2026-23532 · Openclaw · Openclaw

Petr Simecek · Published 2026-02-17 · Updated 2026-03-07 · CVE-2026-28454

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.2 OpenClaw versions 2026.1.30 and earlier

Description When Telegram webhook mode is enabled without a configured webhook secret, the software may accept unauthenticated HTTP POST requests at the Telegram webhook endpoint and trust attacker-controlled update JSON. This can allow forged Telegram updates that spoof message.from.id and chat.id, potentially bypassing sender allowlists and executing privileged bot commands. Attackers can forge Telegram updates by spoofing these fields to bypass sender allowlists and execute privileged bot commands. The vulnerability occurs due to a failure to validate webhook secrets when Telegram webhook mode is enabled. The API endpoint affected is the Telegram webhook endpoint. The vulnerable parameters include message.from.id and chat.id.

Recommendations OpenClaw versions prior to 2026.2.1: Configure a strong channels.telegram.webhookSecret and ensure your reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged. OpenClaw version 2026.1.30 and earlier: Configure a strong channels.telegram.webhookSecret and ensure your reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged.

Fix

Improper Authorization

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-285

CWE-345

Related Identifiers

CVE-2026-28454

GHSA-FHVM-J76F-QMJV

Affected Products

Openclaw

References · 13

• https://github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fhvm-j76f-qmjv · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/5643a934799dc523ec2ef18c007e1aa2c386b670 · Patch
• https://github.com/openclaw/openclaw/commit/633fe8b9c17f02fcc68ecdb5ec212a5ace932f09 · Patch
• https://github.com/openclaw/openclaw/commit/ca92597e1f9593236ad86810b66633144b69314d · Patch
• https://osv.dev/vulnerability/CVE-2026-28454 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fhvm-j76f-qmjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28454 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.1 · Note
• https://twitter.com/CVEnew/status/2030385189818335485 · Twitter Post
• https://twitter.com/CveFindCom/status/2029688946557354396 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authorization-bypass-via-unauthenticated-telegram-webhook · Note