CVE-2026-25474

HIGH
2026-02-19 [email protected] GHSA-mp5h-m6qj-6292
7.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 22:03 vuln.today
PoC Detected
Feb 19, 2026 - 20:13 vuln.today
Public exploit code
Patch Released
Feb 19, 2026 - 20:13 nvd
Patch available
CVE Published
Feb 19, 2026 - 07:17 nvd
HIGH 7.5

Tags

Authentication Bypass AI / ML Openclaw

Description

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Note: Telegram webhook mode is not enabled by default. It is enabled only when `channels.telegram.webhookUrl` is configured. This issue has been fixed in version 2026.2.1.

Analysis

OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSecret` is not configured, allowing attackers with network access to the webhook endpoint to forge Telegram messages and trigger unintended bot actions. Public exploit code exists for this vulnerability. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Verify if OpenClaw is deployed in your environment and check if Telegram webhook mode is enabled with channels.telegram.webhookSecret configured. Within 7 days: Apply the available patch to all affected OpenClaw instances and validate that webhookSecret is properly set. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +38
POC: +20

Share

CVE-2026-25474 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy