Executive brief
OpenClaw, a tool used for media processing and integration, contains a security flaw where sensitive Telegram bot credentials can be accidentally exposed. If a media download from Telegram fails, the system includes the full web address—which contains the secret bot token—in error logs and messages. An attacker who gains access to these logs could take control of the Telegram bot, potentially reading messages or sending unauthorized communications.
Technical details
An information disclosure vulnerability exists in OpenClaw's 'fetchRemoteMedia' function within 'src/media/fetch.ts'. When an inbound Telegram media download fails, the application embeds the original Telegram file URL—which contains the bot's secret token—directly into 'MediaFetchError' strings. These strings are subsequently written to system logs, console output, or other error-reporting surfaces. An attacker with access to these logs can extract the bot token to gain unauthorized access to the Telegram Bot API. The issue was addressed in version 2026.3.13 by implementing a redaction mechanism ('redactMediaUrl') to strip sensitive information from error messages.
Affected products
- OpenClaw OpenClaw < 2026.3.13
Timeline
- 2026-03-14: patched: Fix committed and version 2026.3.13 released.
- 2026-03-14: advisory: GitHub Security Advisory GHSA-xwcj-hwhf-h378 published.
- 2026-03-31: disclosed: NVD publication of CVE-2026-32982.