Executive brief
OpenClaw, a library used for Telegram integrations, fails to limit the number of failed authentication attempts on its webhook interface. This allows an attacker to repeatedly guess the secret key required to communicate with the service. If a weak secret is used, an attacker could successfully impersonate the Telegram service, potentially leading to unauthorized data access or manipulation of bot operations.
Technical details
OpenClaw before version 2026.3.25 is vulnerable to a brute-force attack due to improper restriction of excessive authentication attempts (CWE-307) in the Telegram webhook component. The application rejected incorrect secrets but failed to implement throttling or rate limiting for repeated failed attempts. A remote, unauthenticated attacker can systematically guess webhook secrets without being blocked. Successful exploitation allows the attacker to bypass authentication if weak secrets are in use. The issue was addressed in version 2026.3.25 by adding repeated-guess throttling before authentication failure responses.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: patched: Fix committed to main branch
- 2026-04-09: advisory: NVD published CVE-2026-35628
- 2026-04-10: disclosed: Initial GitHub Advisory published
- 2026-04-18: other: Advisory withdrawn as a duplicate of GHSA-vcx4-4qxg-mfp4