← Back

CVE-2026-28454

nvd nist
Published: Mar 5, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.2
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.

Affected (1)

Products: Openclaw: Openclaw
Openclaw
1 product
Openclaw
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openclaw
Before 2026.2.2

Related CWEs

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (6)

Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
Patch
Source: disclosure@vulncheck.com
MitigationVendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.