Openclaw CVE-2026-41331

Exploitation requires: (1) OpenClaw instance actively monitoring Telegram messages for audio content, (2) Telegram audio preflight transcription feature enabled (non-default or default depending on configuration - not specified in input), (3) Attacker ability to send messages to a Telegram group monitored by OpenClaw (public groups allow any user; private groups require membership but membership may be open), (4) Absent or permissive sender allowlist in the preflight validation logic. No authentication or elevated privileges are required. The vulnerability does NOT require administrative access, API keys, or special Telegram permissions. Default OpenClaw configurations are presumed vulnerable, but exact default settings are not confirmed in the provided data.

CVSS 6.9 (Network/Low Complexity/No Privileges/No User Interaction) indicates broad network accessibility and ease of exploitation, but the impact vector (VA:L - low availability impact) suggests this is a resource degradation rather than complete denial of service. The attack vector (AV:N/AC:L/PR:N) confirms unauthenticated remote exploitation is trivial. However, real-world risk depends critically on infrastructure design: organizations using autoscaling or per-request billing (AWS Lambda, GCP Cloud Functions) face immediate financial risk; those with fixed resources or rate-limiting experience gradual performance degradation. The vulnerability qualifies as CWE-408 (Improper Exception Handling), which is a moderate-severity class. Active exploitation status and EPSS probability are not provided in the input data, limiting confidence in real-world prevalence assessment. The attack requires only network access and Telegram group membership (often public), making the barrier to entry extremely low. This is not a critical RCE but a sustained resource consumption vector with clear financial/availability impact for hosted or cloud-native deployments.

An attacker joins a public Telegram group where OpenClaw is deployed and repeatedly sends specially crafted audio files. OpenClaw initiates transcription preflight processing for each audio message before verifying the sender is authorized to trigger transcription, consuming cloud API quotas and incurring transcription service charges. By scaling this attack across multiple Telegram groups and sending dozens of audio messages per minute, the attacker exhausts the organization's transcription budget or triggers rate-limiting that blocks legitimate users.