CVE-2026-28454CWE-345

OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook

High · published March 5, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00416 · 34.9th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
    cvelistv5