Executive brief
OpenClaw is an open-source tool that integrates with Telegram. A security flaw in its webhook authentication allows attackers to repeatedly guess the secret key used to secure communications without being blocked or slowed down. If a weak secret is used, an attacker could successfully guess it, potentially allowing them to intercept or spoof messages, compromising the integrity of the Telegram integration.
Technical details
OpenClaw versions up to 2026.3.24 are vulnerable to a brute-force attack on the Telegram webhook secret due to a lack of rate limiting (CWE-307). While the system correctly rejects incorrect secrets, it does not throttle or block repeated failed attempts. A network-based attacker can exploit this to guess weak secrets. Successful exploitation allows the attacker to authenticate as a valid Telegram webhook source. The issue is addressed in version 2026.3.25 by adding repeated-guess throttling before authentication failure responses are sent.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: disclosed
- 2026-03-27: advisory: GitHub Advisory published
- 2026-03-25: patched: Fix committed to main branch