Executive brief
OpenClaw is a Node.js library that handles Telegram webhook authentication. The product fails to throttle repeated authentication guesses, allowing attackers to brute-force weak webhook secrets without penalty. An attacker could systematically guess webhook credentials over the network, potentially gaining unauthorized access to Telegram integrations and intercepting or manipulating bot communications.
Technical details
The vulnerability is a missing rate limiting / brute-force protection issue (CWE-307) in Telegram webhook authentication. The vulnerable component rejects bad secrets but does not throttle repeated failed authentication attempts, permitting attackers to guess weak secrets without delay or connection penalties. Attack vector is network-based and requires no authentication or user interaction; an attacker can make unlimited guess attempts against a deployed webhook endpoint. An attacker who discovers a weak webhook secret gains the ability to forge valid Telegram webhook requests and potentially intercept or manipulate bot logic. The fix adds repeated-guess throttling before auth failure responses, implemented in commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7 and released in version 2026.3.25.
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-04-10: disclosed: Advisory published (as withdrawn duplicate)
- 2026-03-26: patched: Original advisory GHSA-vcx4-4qxg-mfp4 published with fix in v2026.3.25