PT-2026-31364 · Npm · Openclaw

Published 2026-03-29 · Updated 2026-03-29

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit 269282ac69ab6030d5f30d04822668f607f13065 enforces DM authorization for callbacks.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 269282ac69ab6030d5f30d04822668f607f13065.

Fix Commit(s)

• 269282ac69ab6030d5f30d04822668f607f13065

Fix

Improper Authorization

Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-288

CWE-863

Related Identifiers

GHSA-J4C9-W69R-CW33

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-j4c9-w69r-cw33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35661 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33 · Note
• https://github.com/openclaw/openclaw/commit/269282ac69ab6030d5f30d04822668f607f13065 · Note
• https://vulncheck.com/advisories/openclaw-telegram-dm-scoped-inline-button-callback-authorization-bypass · Note