CVE-2026-28454
High
Description
OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.
SeverityHigh
CVSS7.5
Exploit probability—
ProductOpenclaw
PublishedMar 5, 2026
First seenMar 5, 2026
Weakness typeCWE-345CWE-345
How to fix
Update
- openclaw openclaw2026.2.2 or later
- openclaw2026.2.1 or later
Patches
- github.com/openclaw/openclaw/commit/ca92597e1f9593236ad86810b66633144b69314d
- github.com/openclaw/openclaw/commit/5643a934799dc523ec2ef18c007e1aa2c386b670
- github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930
- github.com/openclaw/openclaw/commit/633fe8b9c17f02fcc68ecdb5ec212a5ace932f09
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openclaw openclaw | v < 2026.2.2 | 2026.2.2 |
| openclawnpm | v < 2026.2.1 | 2026.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.