https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:37:48 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28454 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>When Telegram webhook mode is enabled without a configured webhook secret, OpenClaw may accept unauthenticated HTTP POST requests at the Telegram webhook endpoint and trust attacker-controlled update JSON. This can allow forged Telegram updates that spoof `message.from.id` / `chat.id`, potentially bypassing sender allowlists and executing privileged bot commands.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.1.30` - Patched: `&gt;= 2026.2.1`</p> <p>## Impact</p> <p>An attacker who can reach the webhook endpoint can forge Telegram updates and impersonate allowlisted/paired senders by spoofing fields in the webhook payload (for example `message.from.id`). Impact depends on enabled commands/tools and the deployment’s network exposure.</p> <p>## Mitigations / Workarounds</p> <p>- Configure a strong `channels.telegram.webhookSecret` and ensure your reverse proxy forwards the `X-Telegram-Bot-Api-Secret-Token` header unchanged.</p> <p>## Fix Commit(s)</p> <p>- ca92597e1f9593236ad86810b66633144b69314d (config validation: `webhookUrl` requires `webhookSecret`)</p> <p>Defense-in-depth / supporting fixes:</p> <p>- 5643a934799dc523ec2ef18c007e1aa2c386b670 (default webhook listener bind host to loopback) - 3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930 (bound webhook request body size/time) - 633fe8b9c17f02fcc68ecdb5ec212a5ace932f09 (runtime guard: reject webhook startup when secret is missing/empty)</p> <p>## Release Process Note</p> <p>`patched_versions` is set to the first fixed release (`2026.2.1`).</p> <p>Th…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>When Telegram webhook mode is enabled without a configured webhook secret, OpenClaw may accept unauthenticated HTTP POST requests at the Telegram webhook endpoint and trust attacker-controlled update JSON. This can allow forged Telegram updates that spoof `message.from.id` / `chat.id`, potentially bypassing sender allowlists and executing privileged bot commands.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.1.30` - Patched: `&gt;= 2026.2.1`</p> <p>## Impact</p> <p>An attacker who can reach the webhook endpoint can forge Telegram updates and impersonate allowlisted/paired senders by spoofing fields in the webhook payload (for example `message.from.id`). Impact depends on enabled commands/tools and the deployment’s network exposure.</p> <p>## Mitigations / Workarounds</p> <p>- Configure a strong `channels.telegram.webhookSecret` and ensure your reverse proxy forwards the `X-Telegram-Bot-Api-Secret-Token` header unchanged.</p> <p>## Fix Commit(s)</p> <p>- ca92597e1f9593236ad86810b66633144b69314d (config validation: `webhookUrl` requires `webhookSecret`)</p> <p>Defense-in-depth / supporting fixes:</p> <p>- 5643a934799dc523ec2ef18c007e1aa2c386b670 (default webhook listener bind host to loopback) - 3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930 (bound webhook request body size/time) - 633fe8b9c17f02fcc68ecdb5ec212a5ace932f09 (runtime guard: reject webhook startup when secret is missing/empty)</p> <p>## Release Process Note</p> <p>`patched_versions` is set to the first fixed release (`2026.2.1`).</p> <p>Th…</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28454 https://db.gcve.eu/vuln/cve-2026-28454 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.</p> https://db.gcve.eu/vuln/cve-2026-28454