CVE-2026-28454: OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28454?
CVE-2026-28454 is considered a high-severity vulnerability due to the risk of unauthorized access through unauthenticated requests.
How do I fix CVE-2026-28454?
To fix CVE-2026-28454, upgrade to OpenClaw version 2026.2.2 or later, which includes validation for webhook secrets.
What types of attacks can exploit CVE-2026-28454?
CVE-2026-28454 can be exploited through unauthorized HTTP POST requests, allowing attackers to send malicious JSON payloads.
Is CVE-2026-28454 present in newer versions of OpenClaw?
CVE-2026-28454 is not present in OpenClaw versions 2026.2.2 and above, as they implement necessary security measures.
What software components are affected by CVE-2026-28454?
CVE-2026-28454 affects all versions of OpenClaw prior to 2026.2.2 using Telegram webhook mode.