PT-2026-23555 · Telegram+2 · Telegram+2

Vincent Koc · Published 2026-02-14 · Updated 2026-03-06 · CVE-2026-28480

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3

Description The Telegram allowlist authorization mechanism incorrectly matched on mutable usernames (@username) instead of immutable numeric sender IDs. This allowed attackers to spoof identity by obtaining recycled usernames, bypassing allowlist restrictions and interacting with bots as unauthorized senders. This poses an identity rebinding and spoofing risk for operators who rely on Telegram allowlists as strict identity controls. The issue was addressed by requiring numeric Telegram sender IDs for allowlist authorization and rejecting usernames. A security audit warning was added to flag legacy configurations containing non-numeric Telegram allowlist entries. The openclaw doctor --fix command now attempts to resolve username allowFrom entries to numeric IDs.

Recommendations Versions prior to 2026.2.14: Update to version 2026.2.14 or later. Versions prior to 2026.1.24-3: Update to version 2026.1.24-3 or later. Run openclaw doctor --fix to resolve any legacy configurations containing non-numeric Telegram allowlist entries.

Fix

Authentication Bypass by Spoofing

Improper Access Control

Weakness Enumeration

CWE-290

CWE-284

Related Identifiers

BDU:2026-06158

CVE-2026-28480

GHSA-MJ5R-HH7J-4GXF

Affected Products

Openclaw

Telegram

Clawdbot

References · 12

• https://github.com/openclaw/openclaw/commit/9e147f00b48e63e7be6964e0e2a97f2980854128 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/e3b432e481a96b8fd41b91273818e514074e05c3 · Patch
• https://osv.dev/vulnerability/GHSA-mj5r-hh7j-4gxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28480 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06158 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://twitter.com/CveFindCom/status/2029689339421086111 · Twitter Post
• https://vulncheck.com/advisories/openclaw-identity-spoofing-via-mutable-username-in-telegram-allowlist-authorization · Note
• https://t.me/CVEtracker/46499 · Telegram Post