PT-2026-32313 · Npm · Openclaw

Published 2026-04-03 · Updated 2026-04-03

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Telegram audio preflight transcription enables resource consumption by unauthorized senders

Current Maintainer Triage

• Status: narrow
• Normalized severity: medium
• Assessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• c4fa8635d03943ffe9e294d501089521dca635c5 — 2026-03-30T12:19:31+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-408

CWE-770

Related Identifiers

GHSA-M6FX-M8HC-572M

Affected Products

Openclaw

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-41331 · Security Note
• https://osv.dev/vulnerability/GHSA-m6fx-m8hc-572m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-m6fx-m8hc-572m · Note
• https://github.com/openclaw/openclaw/commit/c4fa8635d03943ffe9e294d501089521dca635c5 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-resource-consumption-via-unauthorized-telegram-audio-preflight-transcription · Note