OpenClaw EUVD-2026-25324

Three specific conditions must all be present: (1) the OpenClaw instance must have executed the doctor state migration on a version at or below 2026.3.28 - systems that have not yet run migration or that were freshly installed on 2026.3.31+ are not affected; (2) the configuration must define at least one named Telegram account beyond the default - single-account deployments have no additional trust boundary to violate; and (3) the attacker must already be listed in the legacy pairingAllowFrom trust store for the default account, meaning they were previously an authorized Telegram principal on that default account. Exploitation is limited to Telegram channel interactions and does not grant OS-level access, affect other channels, or impact availability. No user interaction is required once the migration has run.

Real-world risk is low despite a network-accessible attack vector. EPSS exploitation probability is 0.06% (19th percentile), CISA SSVC records exploitation as none, and the vulnerability is absent from CISA KEV. No public exploit or POC has been identified. The CVSS 4.0 score of 6.3 with AT:P (Attack Target: Presence required) correctly signals non-trivial pre-conditions: the doctor migration must have been executed, the deployment must have multiple named Telegram accounts, and the attacker must already be listed in the legacy pairingAllowFrom trust store. SSVC rates the vulnerability as Automatable: yes - once conditions are met, no further attacker interaction is needed - but Technical Impact is only partial, confined to the Telegram channel with no availability or scope-change implications. The combination of low EPSS, no active exploitation, a niche npm package footprint, and specific pre-conditions makes this a low operational priority for most organizations, though teams running OpenClaw with multiple Telegram accounts should patch promptly.

A Telegram user previously granted trust on the OpenClaw default account (by appearing in the legacy pairingAllowFrom store) waits for an administrator to run the doctor migration on a vulnerable OpenClaw instance (version <= 2026.3.28) that has multiple named Telegram accounts configured. After migration completes, the attacker's trust is silently propagated to all named accounts, and they can send authenticated Telegram commands to bot integrations they were never authorized to access. No public exploit code exists; exploitation is passive once the migration runs.